A use‑after‑free flaw in Microsoft Office Excel allows an attacker to run arbitrary code on the target system. The weakness, identified as CWE‑416, means that memory that has already been freed can be accessed again, giving the attacker control over execution flow. Successful exploitation leads to full compromise of the affected machine, enabling the attacker to execute arbitrary commands, steal data, or establish persistence.

Affected systems include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific operating system or version numbers are listed in the advisory, so any installation of these products is presumed vulnerable.

The CVSS score of 8.8 indicates a high severity flaw. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the description states that code can be executed over a network. The likely attack vector is a network‑based delivery of a malicious Excel document; the attacker does not need local access but must get the target to open or process the payload, which may happen via email, instant messaging, or a shared network location.