Technical impact
An out‑of‑bounds read flaw in Microsoft Office Excel allows a local attacker to read sensitive data from memory. The vulnerability results in the leakage of confidential information, thereby compromising confidentiality. The weakness is categorized as improper memory read (CWE‑125).
Affected Systems
Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. The flaw is present in the Excel component of these Microsoft Office suites.
Risk and Exploitability
The CVSS score of 5.5 classifies the vulnerability as moderate severity. EPSS data is not available, so the current exploitation probability cannot be quantified, and the flaw is not listed in the CISA KEV catalog. Based on the description, the target is a local user who has access to the affected Office installation; the attack does not rely on network‑based remote exploitation. The risk to systems is limited to information disclosure when an attacker can open or execute a malicious Excel file locally.
