A heap-based buffer overflow exists in Microsoft Office Excel that allows an attacker with network access to arbitrarily execute code. The flaw can be triggered through a maliciously crafted spreadsheet or document accessed remotely, exposing the host to full compromise of confidentiality, integrity, and availability. The vulnerability is a classic example of CWE-122, a buffer overflow that permits control over execution flow when unchecked memory is written.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are all susceptible. All currently supported installations of these products are affected; no specific version qualifiers were disclosed beyond the product line.

The CVSS score of 8.8 places the issue in the high severity range, indicating that exploitation could lead to critical compromise. Although the EPSS score is not available, the absence of an EPSS rating does not imply low risk—many high‑impact buffer overflows can be exploited with modest effort once a trigger is known. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but given its nature and history of similar Excel flaws, it is likely a target for both supply‑chain and direct network attacks. An attacker would need to deliver the malformed Excel file or trigger the overflow via a network‑exposed service, and then execute code with the privileges of the user running Excel. The attack surface is larger on shared or untrusted systems where users routinely open documents from external sources.