The vulnerability is a stack‑based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. This flaw can result in remote code execution on any system that processes a malicious file. It is classified as CWE‑121, indicating that attacker‑controlled data can overwrite control flow instructions on the stack.

Affected by the vulnerability are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific version ranges are listed, so all current releases of these products are considered vulnerable until an official update is applied.

The CVSS score of 8.8 denotes a high severity remote code execution vulnerability, and the absence of an EPSS value means exploitation likelihood is currently unknown. The CVE is not listed in the CISA KEV catalog, indicating that no confirmed exploits are publicly documented at this time. The likely attack vector is a network‑based delivery of a crafted workbook that triggers the overflow. Due to the lack of an EPSS score, defensive priority should be balanced with the high impact of potential exploitation.