A heap‑based buffer overflow in Microsoft Office Excel enables an attacker to execute arbitrary code on a victim machine. The flaw is triggered through specially crafted Office files transmitted over a network. Successful exploitation results in remote code execution with the permissions of the user running the affected Excel process. This type of vulnerability can compromise confidentiality, integrity, and availability of the system and is classified as high severity (CVSS 8.8).

The vulnerability affects multiple Microsoft products. Affected clients include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and the Office Online Server. Users of any of these editions are at risk unless the security update is applied.

The CVSS score of 8.8 indicates a high likelihood of serious impact. Because the EPSS score is not available, the precise exploitation probability is unknown, but the vulnerability is network‑based, implying it can be abused from a remote victim machine. The vulnerability is not listed in CISA’s KEV catalog, yet its high severity warrants immediate attention. Applying the vendor’s update should be the primary response; until the patch is deployed, restricting Excel’s ability to open network‑based documents and tightening access to Office Online Server resources can reduce exposure.