Local code execution via numeric truncation

Code execution in Microsoft Office Excel in multiple Microsoft Office and Office Online Server releases allows attackers to execute code locally via unspecified vectors. Public sources do not identify the parsing routine; Microsoft has disclosed only a numeric truncation error and a heap-based buffer overflow mapping, indicating that Excel narrows an untrusted numeric value before a heap write or allocation uses it. The published CVSS 3.1 vector shows no prior privileges but required user interaction and local reachability, so exploitation is gated on local delivery into an Excel processing path and yields code execution in the current user's context.