A stack‑based buffer overflow was discovered in Microsoft Office Excel that allows an attacker to execute arbitrary code. The flaw occurs when Excel processes specially crafted content, potentially leading to full system compromise if exploited. The weakness is classified as CWE‑121, indicating that untrusted input can corrupt the stack and control flow. The impact is severe, as the attacker can gain arbitrary code execution with the privileges of the user running Excel, hence affecting confidentiality, integrity, and availability of the affected systems.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and the Office Online Server. Detailed version information is not provided, so all current releases within these product lines may be impacted; users should verify their specific build numbers against the Microsoft security advisory.

The CVSS score of 8.8 marks this flaw as high severity. Although the EPSS score is not available, the lack of a KEV listing does not diminish the risk; many similar buffer overflows have been observed in the wild. The exploitation requires network access to the target computer and the receipt of a malicious spreadsheet or grouped file, implying that remote code execution can be achieved without user interaction beyond opening the file. Attackers could use readily available tools or crafted documents to trigger the overflow, placing the affected systems at significant risk.