The flaw is a heap‑based buffer overflow in Microsoft Office Excel that permits an attacker to run arbitrary code. When an unsigned or modified Excel file is opened over a network, the overrun corrupts heap metadata and can hijack control flow. The vulnerability is represented by CWE‑122 and can lead to full system compromise, including data theft, persistence, and lateral movement for the attacker.

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Version information was not disclosed in the public report.

The CVSS score of 8.8 indicates high severity. The EPSS score is not provided, so the probability of exploitation is uncertain, but the vulnerability can be triggered remotely by opening a crafted Excel document. The issue is not currently listed in the CISA KEV catalog. An attacker with network access to a targeted machine can upload or send the malicious workbook and obtain code execution, potentially compromising the entire environment.