Code execution via undisclosed buffer over-read

Buffer over-read in Microsoft Excel in affected Office releases allows local users to execute arbitrary code through locally supplied data. Excel reads beyond the end of an internal buffer while processing untrusted data, but Microsoft has not disclosed the parser, file format, or function involved. The attack requires access to invoke Excel with attacker-controlled data; successful exploitation runs code in the affected process context.