A critical type confusion vulnerability in Microsoft Office Excel permits an unauthorized local attacker to execute arbitrary code on the host system.

The vulnerability is a type confusion flaw (CWE-843) occurring during the processing of Excel files, which can be triggered by an attacker to achieve local code execution. The attack requires user interaction, typically through the opening of a malicious file.

This vulnerability carries a CVSS score of 7.8, reflecting its high severity due to the potential for total compromise of system integrity, availability, and confidentiality. Successful exploitation allows an attacker to gain the same level of access as the current user, which could lead to data exfiltration, lateral movement within the network, or the installation of persistent malware.

Immediate Action: Apply the latest security updates provided by Microsoft via the official update guide at https://aka.ms/OfficeSecurityReleases.

Proactive Monitoring: Review endpoint security logs for suspicious Excel activity or unexpected child processes spawned by the Excel application.

Compensating Controls: Implement file integrity monitoring and ensure that macro security settings are configured to prevent the execution of untrusted documents.

Public Exploit Available: Unknown.

Given the high CVSS severity and the potential for code execution, organizations should prioritize the deployment of the vendor-supplied patches across all affected Excel environments. Users should be cautioned against opening unsolicited or suspicious Excel attachments from untrusted sources while the update process is underway.