Code execution via untrusted pointer dereference

Untrusted pointer dereference in Microsoft Excel allows attackers to execute code via crafted workbook content opened locally. Microsoft has disclosed only that Excel dereferences an untrusted pointer; the vulnerable parser, feature, and file format have not been published in the CVE record or Microsoft advisory. Exploitation requires user interaction under the published CVSS vector, so exposure depends on whether users or Office Online Server workflows process attacker-supplied workbooks.