The vulnerability arises from using an uninitialized resource in Microsoft Office Excel, allowing an attacker who can run Excel locally to trigger a path that leaks sensitive data from memory or the file system. This results in local information disclosure and is categorized under CWE‑908. While the disclosed data is confined to the compromised host and does not include remote code execution, exposure of internal details could facilitate further attacks.

Affected Microsoft products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The CVE covers both 32‑bit and 64‑bit builds across Windows and macOS platforms, but no specific sub‑versions were listed.

The CVSS score of 5.5 reflects moderate severity, and the EPSS score is less than 1% indicating a very low expected exploitation rate. The vulnerability is not included in the CISA KEV catalog. Attackers must already have local, authorized‑level access to a victim machine to exploit the flaw; thus the primary attack vector is local execution. The exploit path likely involves an untrusted workbook that forces Excel to use the uninitialized resource, causing unintended data leakage.