The CVSS 7.8 headline obscures what makes this值得关注: it's a heap-based buffer overflow in Excel's file parsing layer, which fundamentally changes the threat model compared to a network-adjacent RCE. The attacker needs either local code execution or must socially engineer a user into opening a malicious file—that's a high bar that limits which threat actors can use this, but it's not the end of the story.
What matters more than the CVSS score is the blast radius. A heap overflow in Excel on a privileged workstation isn't a spreadsheet problem—it终端 impact reaches every system that machine has access to. The machine likely holds OAuth tokens to SharePoint, Teams, and M365 cloud resources. It probably has credentials cached for financial systems, deal rooms, or HR pipelines that consume Excel exports as trusted data. The AV:L constraint limits initial access, not what a compromised endpoint can reach. Microsoft's integrated identity model means a exploited Excel instance carries access tokens to infrastructure far beyond the local machine.
The CVSS/EPSS gap (7.8 severity but 0.00332 probability) tells you something useful: Microsoft's exploit mitigations—ASLR, heap hardening, Protected View sandbox—make reliable exploitation genuinely difficult in practice. That doesn't mean this is harmless; it means the exploitation barrier is technical rather than access-based. The interesting question is whether this signals a vulnerability cluster. Excel's parsing layer has had features bolted onto it for three decades while maintaining backward compatibility with .xls, .xlsx, .csv, and legacy formats. Heap overflows in Office file parsers follow a documented lifecycle: high CVSS paired with low EPSS, treated as non-urgent, then a public PoC emerges and the exploitation calculus shifts exactly when organizations have habituated to treating the pattern as low-priority.
The operational wrinkle is Click-to-Run. Microsoft 365 Apps update through a different channel than traditional security patches, and many enterprises treat these as regular updates rather than vulnerabilities. That creates structural latency in remediation—not because organizations are negligent, but because classification at intake drives the response timeline. The window between disclosure and median enterprise patching for this class of vulnerability is where cumulative exposure accumulates.
What to do: prioritize patching Excel on privileged accounts (finance, executive, IT admin workstations) where the blast radius from a successful exploit reaches high-value cloud resources. Treat M365 Click-to-Run updates through your vulnerability management pipeline, not your update management pipeline. Monitor for public PoC emergence—this is the inflection point where the EPSS probability jumps and exploitation becomes reliable.