Heap-based buffer overflow in Microsoft Office Excel permits an unauthorized attacker to execute code when a malicious Excel file is processed over a network. The flaw allows arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system. The impact extends to any user who opens a specially crafted Excel document, potentially enabling full system takeover or malicious payload delivery.

Vendors and products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Version details are not specified in the available data.

The CVSS score of 8.8 signals a high severity vulnerability, and the effect is remote code execution. EPSS data is not available, and the issue is not listed in CISA's KEV catalog, implying no known public exploitation yet. However, the attack vector is over a network, meaning that the vulnerability can be triggered by receiving a malicious file from an external source. The combination of high severity and network-based access results in a high overall risk, especially for environments that routinely handle externally sourced Excel spreadsheets.