The vulnerability is an out‑of‑bounds read in Microsoft Office Excel that can be exploited by an unauthorized attacker to initiate local code execution, as stated in the official description. This allows the attacker to run arbitrary code on the victim's machine, potentially compromising confidentiality, integrity, and availability. The weakness corresponds to CWE‑125.

Affects Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office Online Server. The specific affected versions are not listed, but all editions of the listed products are impacted.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1% suggests a relatively low current exploitation probability. The vulnerability is not in the KEV catalogue, indicating no confirmed widespread exploitation. The likely attack vector is through a malicious Excel file that forcefully reads beyond allocated memory, first inferred from the description of an unauthorized attacker executing code locally. Successful exploitation would require the victim to open or otherwise process the crafted file, after which arbitrary code can run under the user’s privileges.