A flaw in Microsoft Office Excel causes an out‑of‑bounds write that permits an attacker to execute arbitrary code. The vulnerability is triggered when Excel processes a malicious workbook or file, enabling memory corruption that can be leveraged to run code with the privileges of the Office process.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server.

The CVSS score of 8.8 indicates high severity. EPSS information is missing, so the probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user delivering or sharing a corrupted Excel file over a network or through Office Online Server, allowing code execution on the victim’s machine. No other prerequisites are detailed in the CVE description.