The vulnerability is a heap‑based buffer overflow in Microsoft Office Excel that allows an attacker to execute arbitrary code when the application processes a specially crafted file. Because the code runs with the privileges of the logged‑in user, the attacker can read and modify any data on the computer, tamper with system files, or install additional malware, potentially compromising confidentiality, integrity, and availability.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are all affected. No specific version constraints were provided in the CVE data.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS value means the exploitation probability is currently unknown. The vulnerability can be triggered by sending a malicious Excel file over a network—such as via email attachment, shared drive, or Office Online—to a victim who opens it, leading to remote code execution. The vulnerability is listed as not in the CISA KEV catalog, so no publicly listed exploits have been confirmed, but the high severity and nature of the flaw suggest the risk of a successful exploit is significant if the system is not patched.