An incorrect bounds check in Microsoft Office Excel allows an out‑of‑bounds read that can be exploited by an unauthorized attacker to execute arbitrary code on a target machine. The flaw provides the attacker with the ability to run arbitrary instructions, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is characterized by CWE‑125 (Out‑of‑Bounds Read) and CWE‑20 (Improper Input Validation).

The flaw affects several Microsoft Office deployments, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Any instance of these products that has not applied the latest security updates is potentially vulnerable.

The CVSS score of 8.8 classifies this vulnerability as High severity. The EPSS score is currently not available, and the flaw is not listed in the CISA KeV catalog. The likely attack vector is network‑based, where an attacker can construct a malicious spreadsheet that, when opened by an affected user, triggers the out‑of‑bounds read and leads to code execution. No special user privileges are required beyond the ability to open the crafted file, making the exploitation scenario relatively straightforward for an attacker who can deliver the file over the network.