The vulnerability arises because HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files such as CSV, XLS, and XLSX before they are processed or distributed. When a malicious user populates specific data fields, the resulting CSV file could attempt the exfiltration of data or trigger other malicious activity when automatically executed by spreadsheet software. The CVSS score of 4.6 indicates a moderate level of severity, and the risk is primarily for confidential data leakage or local execution of spreadsheet content.

All versions of HCL Software’s BigFix Service Management (SM) are potentially affected, as the CVE entry does not provide a narrower version scope. Users of this product should assume that any deployment that accepts spreadsheet uploads is impacted.

The CVSS rating reflects moderate impact; the EPSS score is not available, so the exploitation probability is not quantified, and the vulnerability is not listed in CISA’s KEV catalog. The typical attack requires an adversary to upload a malicious spreadsheet file to the system and a user to open that file, thereby triggering execution of the embedded content. The risk is largely confined to environments where spreadsheet files are processed automatically or opened by users who may not be aware of the untrusted content warning in current versions of Excel.