A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute arbitrary code on the target machine over a network. The overflow can lead to the compromise of confidentiality, integrity, or availability by enabling malware installation or data exfiltration.

Microsoft Office products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. No specific version information is provided beyond the product families.

The flaw has a CVSS score of 8.8, indicating high severity. Exploitation is possible remotely over a network when a malicious file is opened by a user. The EPSS score is not available, and the vulnerability is not presently listed in the CISA KEV catalog. Attackers do not need elevated privileges; they can exploit the flaw by delivering a crafted spreadsheet to a target over a network.