A heap-based buffer overflow exists in Microsoft Office Excel. The flaw allows an unauthorized attacker to execute arbitrary code on the target system when a specially crafted document is opened over a network. This leads to remote code execution, bypassing user permissions and potentially exposing the victim system to further compromise. The weakness is classified as CWE-122.

Affected products include Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office Online Server. All current releases of these variants are impacted; no specific version list is provided in the advisory.

The vulnerability carries a CVSS score of 8.8, classifying it as high severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. The most likely attack vector is a remote network-based delivery of a malicious Excel file that the victim opens, leading to arbitrary code execution on the victim machine.