A critical type confusion vulnerability in Microsoft Excel permits an unauthorized attacker to execute arbitrary code when a user opens a malicious file.

The flaw is caused by type confusion (CWE-843) when processing resources. An attacker can exploit this by enticing a user to open a malicious document, resulting in remote code execution with the permissions of the current user.

This vulnerability carries a CVSS score of 8.8, indicating a high risk of remote code execution. If exploited, an attacker could gain complete control over the victim's workstation, leading to significant data breaches, the installation of malware, or lateral movement within the corporate network.

Immediate Action: Update Microsoft Office and Excel installations to the latest available versions via the official Microsoft security release portal.

Proactive Monitoring: Monitor endpoint detection and response systems for suspicious process spawning from the Excel application.

Compensating Controls: Utilize email filtering solutions to block potentially malicious attachments and encourage users to utilize Protected View for documents from untrusted sources.

Public Exploit Available: false

Given the potential for remote code execution, organizations should treat this update with high priority. Ensure that all Office software is updated and warn users against opening unexpected or untrusted Excel documents.