Double free in Microsoft Office Excel allows an attacker to execute arbitrary code over a network. The flaw, categorized as CWE‑415, can compromise confidentiality, integrity, and availability of the affected system. An attacker who can deliver a specially crafted workbook or payload to a vulnerable machine can gain full control of the application and potentially the host without authentication.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server.

The CVSS score of 8.8 indicates high severity, and the EPSS score is currently unavailable, while the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to deliver the malicious content over a network to the victim’s Office installation. No publicly disclosed exploit exists at this time, but the high severity combined with the vulnerability’s network reach underscores a significant risk to affected environments.