A heap‑based buffer overflow exists in Microsoft Office Excel, enabling a local attacker to read adjacent memory and expose sensitive data. The vulnerability can lead to disclosure of arbitrary information present on the same machine, compromising confidentiality. The weakness is identified as CWE‑122 and carries a CVSS score of 6.6, attack executed only by a user who can open the affected Excel file locally; there is no evidence of a remote exploitation path.

Affected products include Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office Online Server. All listed versions are impacted; no additional version constraints are specified.

The CVSS score of 6.6 and an EPSS score of less than 1 % indicate that while the vulnerability is moderate, the probability of real‑world exploitation is very low. The attack vector is local, implying that an attacker must have physical or user‑level access to the target system. Because the flaw is a heap buffer overflow, exploitation would allow the attacker to read memory contents. The vulnerability is not currently listed in the CISA KEV catalog, so large‑scale attacks are currently unlikely. Nevertheless, any unpatched system that allows untrusted users to open Office files remains at risk of accidental or intentional data disclosure.