A heap‑based buffer overflow in Microsoft Office Excel allows an attacker that can supply data over a network to execute arbitrary code on the target machine. The flaw is triggered by malicious content processed by Excel, giving the attacker control over the affected process without needing local privileges. This can lead to full system compromise, credential exfiltration, or persistence by installing malware.

The vulnerability affects multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office Online Server.

The CVSS score of 8.8 classifies this issue as high severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, but the lack of public information does not diminish the potential impact. The attack vector is network‑based and requires that the malicious content be delivered to Excel for processing, which can happen through shared documents, email attachments, or web‑based Office Online.