This vulnerability is a use‑after‑free flaw in Microsoft Office Excel that permits an unauthenticated attacker to execute arbitrary code on a target system. The flaw can be triggered from a network location, giving the attacker the same privileges as the user who opens a malicious Excel file. The resulting impact is full compromise of the affected system, including data theft, installation of malware, or pivoting to other network assets. The weakness is categorized as CWE‑400 and CWE‑416, highlighting both resource exhaustion and memory safety concerns.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. These versions span both Windows and macOS deployments of the Office suite.

The CVSS score of 8.8 places this flaw in the high‑severity range and indicates that successful exploitation can provide full system access. While the EPSS score is currently unavailable, the absence of a KEV listing does not diminish the risk, as the vulnerability can be exploited over the network with crafted Excel files. The likely attack vector is an unauthenticated network attacker who can deliver a malicious spreadsheet to a user or distributed via shared drives, inferring that local privilege is not required beyond the Office process.