Microsoft Excel Remote Code Execution Vulnerability

A use-after-free vulnerability has been identified in Microsoft Office Excel, allowing an unauthorized attacker to execute code locally. This issue affects multiple versions of Excel, including the 2016 32-bit and 64-bit editions, as well as various editions of Microsoft Office LTSC 2021 and 2024 for both Mac and Windows. The vulnerability arises from improper memory management, which can be exploited by sending a malicious file to the user and convincing them to open it.

Impact

Exploitation of this vulnerability could lead to unauthorized local code execution on the affected system.

Remediation

Users can apply the security update KB5002758 for Microsoft Excel 2016 or the relevant security update for their version of Microsoft Office LTSC 2021 or 2024. Instructions for downloading these updates are available on the Microsoft Office Update page.