Microsoft Office Excel contains an out‑of‑bounds read that allows an unauthorized attacker to read memory contents and exfiltrate the data over a network. The flaw enables the disclosure of potentially sensitive information from the Excel process to the attacker without needing local access. It is a classic memory disclosure vulnerability (CWE‑125).

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No specific version numbers are listed, so all installations of these products are potentially vulnerable until patched.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The likely attack vector is over a network, meaning an attacker who can communicate with the target system, possibly via local network or remote VBA execution. Given the moderate CVSS and the potential for sensitive data exposure, the risk is non‑negligible, especially in environments where Excel is used for confidential documents.