Microsoft Excel Use-After-Free Vulnerability Allowing Local Code Execution

A use-after-free vulnerability has been identified in Microsoft Office Excel. This issue allows an unauthorized attacker to execute code locally. The vulnerability arises from improper memory management, which can be exploited by manipulating the way Excel handles certain objects.

Impact

Exploitation of this vulnerability could lead to remote code execution on the affected system.

Remediation

Users can download the security update for Microsoft Excel 2016 (both 32-bit and 64-bit editions) from the Microsoft Update Catalog. For Microsoft Office LTSC 2021 and 2024 (both 32-bit and 64-bit editions), security updates are not yet available but will be released as soon as possible. Microsoft 365 Apps for Enterprise users can also download the security update from the Microsoft Update Catalog. Office Online Server users can download the security update from the Microsoft Update Catalog as well.