A heap-based buffer overflow in Microsoft Office Excel enables an attacker who has network access to execute arbitrary code on the target system. The vulnerability could allow compromised code to run with the privileges of the Office process, potentially bypassing sandbox restrictions and gaining further access. Because the flaw occurs on the heap, it can be triggered by carefully crafted content that causes the program to write beyond the bounds of a buffer.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server, all versions listed as vulnerable. The specific version numbers are not enumerated in the CNA data, so any installation of the listed products before the latest security update is potentially at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, so the exact probability of exploitation cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is over a network where the attacker can deliver malicious content through shared documents or services, and the exploitation would require the victim to open a specially crafted file or otherwise trigger the overflow condition.