A use‑after‑free flaw in Microsoft Office Excel allows an attacker with network access to run arbitrary code – a classic form of remote code execution. The vulnerability occurs when a freed memory block is reused, enabling the attacker to inject malicious payloads that are executed with the privileges of the Office application on the target machine. If exploited, the attacker can gain full control of the affected computer, compromising confidentiality, integrity, and availability of information within the organization.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office Online Server. No specific version numbers are listed in the advisory, so all releases of these products should be treated as vulnerable until Microsoft publishes a detailed scope.

The CVSS score of 8.8 classifies this flaw as high‑severity. The exploit probability (EPSS) is not available in the advisory, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. However, because the flaw permits remote code execution over a network, the potential impact is significant. Attackers would need to deliver malicious content to an Excel instance – typically via a crafted workbook or a network‑based delivery mechanism. Successful exploitation would grant the attacker full control of the victim’s system.