A heap‑based buffer overflow in Microsoft Office Excel allows an attacker without authentication to execute arbitrary code on a target system by sending a specially crafted spreadsheet. The vulnerability can be leveraged to run malicious payloads with the privileges of the current user, potentially escalating to higher privileges depending on the environment.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Office LTSC 2021 and 2024 for Windows, Office LTSC for Mac 2021 and 2024, and Office Online Server are all affected. No specific version numbers are listed, so the flaw may exist in all supported releases of these products.

The CVSS score of 8.8 indicates high severity. Because the exploit does not require authentication and can be performed remotely over a network, the threat of exploitation is significant, especially in environments where Excel files are exchanged via email or shared network drives. EPSS information is not available and the CVE is not listed in CISA’s KEV catalog, but the high CVSS and the presence of a Microsoft advisory suggest that attackers may target this flaw in the near term.