The vulnerability is a heap‑based buffer overflow in Microsoft Office Excel. An unauthorized attacker who can send crafted data to the application may trigger the overflow and execute arbitrary code with the privileges of the user running Excel. This can lead to full compromise of the affected system, disclosure of data, or persistence of malicious payloads. The weakness is identified as CWE-122.

Products impacted include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Because the advisory does not list specific release numbers, all current versions of these products that contain the Excel component are potentially vulnerable.

A CVSS score of 8.8 signifies high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV, indicating that exploitation is not yet widespread. However, the flaw can be triggered over a network, meaning remote attackers can exploit it without physical access. Organizations should prioritize this vulnerability as a high‑risk threat and apply the official update or mitigate accordingly.