Microsoft Office Excel contains an out‑of‑bounds read that can be exploited by an unauthorized attacker to execute code remotely. This flaw enables an attacker to trigger arbitrary code execution through a malicious Excel workbook or document, potentially compromising systems that run the affected office products. The weakness is identified as CWE‑125, representing a classic memory corruption vulnerability that the attack exploits to run code with the privileges of the user.

The flaw affects numerous Microsoft Office suites, including Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021 and LTSC 2024 (both Windows and Mac), SharePoint Server Subscription Edition, and Office Online Server. The vulnerability is present in all listed product versions and in the long‑term servicing channels for the 2021 and 2024 releases.

The CVSS score of 8.8 categorises this vulnerability as High severity. The EPSS score is not available, meaning publicly measurable exploit activity is unknown, and the flaw is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is a network‑based delivery of a malicious Excel workbook or a Office Online Server‑based attack. An attacker with network access can therefore achieve remote code execution if the victim opens the compromised file or connects to Office Online, provided no additional security controls are in place.