The vulnerability is an improper input validation flaw that allows a local attacker to read sensitive information from memory or data structures that should be protected. It is classified under CWE-125 and CWE-20, indicating out‑of‑bounds reads and generic input validation weaknesses. The confirmed effect is that an unauthorized user with local access to a Microsoft Office Excel environment can observe confidential data that the application handles but should not expose to the user, thereby undermining confidentiality.

The affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office Online Server. No specific version numbers are provided in the CNA data, so the issue applies broadly to the mentioned releases.

The CVSS score of 5.5 indicates a moderate risk. Exploit probability, as shown by EPSS, is less than 1%, suggesting that active exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, further indicating lower operational priority. The primary attack vector is local; an adversary must already have been on the same system or have the ability to run malicious code within the Excel process to leverage the flaw.