The vulnerability is an out‑of‑bounds read in Microsoft Excel that permits an attacker to execute arbitrary code on the victim’s machine. This flaw arises from improper bounds checking of data within the application, leading to a potential code execution path. The impact is compromise of confidentiality, integrity and availability for the affected system, as a malicious workbook can trigger code under the user’s context.

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024 and Microsoft Office Online Server are explicitly impacted. Version information from CPE listings indicates that both 64‑bit and 32‑bit builds of these suites are affected, including the long‑term servicing channel releases for 2021 and 2024. Specific patch levels are not enumerated in the source, so any build lacking the latest cumulative update should be considered vulnerable.

The CVSS score of 7.8 denotes high severity while the EPSS score of less than 1% suggests that exploitation is currently rare. The flaw is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. Attackers would likely deliver a crafted workbook to the target; based on the description, the likely attack vector is via file download or email attachment, though the CVE entry does not specify network exposure. Given the high impact and low current exploitation probability, proactive patching is advised.