An use‑after‑free bug in Microsoft Office Excel allows an unauthorized attacker to execute code on a system that has Excel opened. The flaw is a classic invalid memory reference that can be triggered by processing a malicious file or document, resulting in remote code execution. This vulnerability can compromise confidentiality, integrity, and availability of the affected system and can be leveraged to install malware or establish persistence.

The affected applications include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. No specific version numbers are listed, so all releases in the specified product lines are potentially impacted.

The CVSS score of 8.8 indicates high severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is not available, but since the issue allows code execution over a network and is likely exploitable by an attacker who can supply a malicious document or payload, the practical risk is significant for networks that expose Office applications to untrusted input. Attacks would likely involve an unauthorized network attacker crafting and delivering a specially formatted file that triggers the use‑after‑free condition.