A heap-based buffer overflow in Microsoft Office Excel enables an unauthorized attacker to execute code across a network. The vulnerability arises from improper input validation and a lack of bounds checking, allowing maliciously crafted data to corrupt heap memory and transfer control to attacker-supplied code. The resulting impact is a loss of confidentiality, integrity, and availability for affected systems, with the potential for full system compromise if the code runs with elevated privileges.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. These versions span both Windows and macOS platforms, encompassing long‑term servicing channels and online server deployments.

The CVSS score of 8.8 indicates high severity and the lack of an EPSS score means there is no quantifiable exploitation probability available yet; however, the CVE is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based, requiring the delivery of a crafted Office file or a similar payload to a vulnerable Excel instance. With remote code execution as the primary impact, the risk to organizations is significant, especially if systems are exposed to untrusted network locations or email attachments.