The vulnerability is a heap-based buffer overflow located in Microsoft Office Excel. When a maliciously crafted workbook is opened over a network, the overflow allows an adversary to execute arbitrary code with the privileges of the current user. This constitutes a remote code execution issue and falls under CWE‑122, reflective of improper handling of memory.

The affected products are all Microsoft Office offerings listed by Microsoft, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Exact version numbers are not provided, so all revisions covered by the listed CPEs are considered vulnerable.

The CVSS score of 8.8 indicates high severity, and no EPSS score was supplied, so exploitation probability cannot be quantitatively measured. The vulnerability is not yet listed in CISA KEV, but the possibility of remote exploitation remains clear. The attack vector is inferred to be network‑based, requiring the attacker to deliver a crafted Excel file to the victim. Given the high potential impact and the lack of readily available mitigation aside from patching, the risk is significant.