Technical impact
The reported flaw is an out‑of‑bounds read that occurs during Excel processing. An attacker can trigger it and cause the application to read memory beyond its buffer, revealing sensitive data that may exist in adjacent memory. The vulnerability can be abused by an unauthorized attacker to exfiltrate information over a network, affecting confidentiality of data stored or processed by Excel.
Affected Systems
Affected are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, which include the Excel component in those suites. The issue applies to all installed versions of these packages that contain the mentioned Excel component.
Risk and Exploitability
The CVSS score is 6.5, indicating moderate severity. The EPSS score is not available, so we cannot gauge current exploitation likelihood, and the vulnerability is not listed in CISA's KEV catalogue. Given that the disclosure requires the attacker to supply an input that triggers the out‑of‑bounds read, which can be achieved through a crafted Office file or network connection, the attack vector is inferred to be remote exploitation via a malicious file or network message. The impact is limited to information disclosure; no remote code execution or denial of service is reported.
