Microsoft Excel Heap-Based Buffer Overflow Vulnerability Allowing Local Code Execution

A heap-based buffer overflow vulnerability has been identified in Microsoft Office Excel. This vulnerability allows an unauthorized attacker to execute code locally. It affects multiple versions of Excel, including Excel 2016 (both 32-bit and 64-bit editions), Office LTSC for Mac 2024, Office LTSC 2024 for 32-bit and 64-bit editions, Office LTSC 2021 for 32-bit and 64-bit editions, Office LTSC for Mac 2021, Microsoft 365 Apps for Enterprise for both 32-bit and 64-bit systems, Office 2019 for 32-bit and 64-bit editions, and Office Online Server.

Impact

Exploitation of this vulnerability could lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system.

Remediation

Users can download the security update for Microsoft Excel 2016 (32-bit and 64-bit editions) from the Microsoft Update Catalog. For Office LTSC and Microsoft 365 Apps for Enterprise users, security updates are also available through the Office Update mechanism. Office Online Server users can download the security update from the Microsoft Update Catalog.