A heap-based buffer overflow flaw in Microsoft Office Excel permits an attacker to execute arbitrary code. The weakness is a memory corruption bug that can be triggered by specially crafted input and is classified as CWE-122. If successfully exploited, the attacker can gain code execution privileges on the affected machine, potentially allowing full compromise of the system and data exposure.

The products impacted are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office Online Server. All of these Microsoft Office applications are affected, regardless of the specific OS platform, as the vulnerability resides in the core Excel engine shared across editions.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available, so a precise exploitation probability cannot be established. Since the description notes that an unauthorized attacker can execute code over a network, the likely attack vector is remote exploitation of network-accessible Office applications. The vulnerability is not listed in CISA’s KEV catalog, which suggests that public exploitation may not yet be widespread, but the high severity and ability to run code remotely pose a significant risk to affected organizations.