Out-of-bounds read in Microsoft Office Excel allows an attacker to read memory beyond intended bounds, potentially enabling code execution on the local machine. This flaw (CWE-125) compromises confidentiality, integrity, and availability of the affected system, as an attacker can run arbitrary code after the vulnerability is triggered.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and 2024. No specific patch versions are listed, so all installations of these products are potentially vulnerable.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of less than 1% implies a low probability of exploitation in the wild, and the vulnerability has not been noted by CISA in its KEV catalog. The attack vector is not explicitly defined in the description; the likely vector is a malicious document that a user opens locally, inferring the need for caution when handling unknown files.