An out‑of‑bounds read within Microsoft Excel permits an attacker who can trigger the vulnerability to read data from memory that should not be exposed. The consequence is that sensitive data may be disclosed over a network to the attacker, potentially leaking confidential information. The weakness is identified as CWE‑125, which describes an attempt to read past an array’s bounds, leading to unauthorized data exposure.

Affected are Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, Microsoft Office LTSC for Mac 2021 and 2024, and Office Online Server. Specific version ranges are not provided in the advisory, meaning any installation of the listed products could be vulnerable if not patched.

The CVSS score of 3.3 classifies this vulnerability as low severity. No EPSS score is available, so the probability of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based local attacker who can cause or influence the vulnerable read operation, which suggests that the threat is mainly local or internal to the network. The impact is limited to information disclosure; there is no evidence of escalation, execution, or denial of service.