The vulnerability is an out-of-bounds read in Microsoft Office Excel. If exploited, it allows a local, unauthorized user to read arbitrary sensitive data that should be protected by the application, leading to local information disclosure. This weakness stems from inadequate bounds checking in the handling of Excel documents and is identified as CWE‑125.

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office Online Server are all affected. No specific version information is provided; all currently deployed builds are susceptible.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog, and the attack vector is inferred to be local, requiring an unauthorized user to be present on the same system.