An out‑of‑bounds read in Microsoft Office Excel can be exploited by an attacker to run arbitrary code on a victim’s system. The flaw allows an unauthorized user to read memory beyond the intended boundary, leading to execution of malicious code over a network when Excel processes a crafted file. This represents a significant breach of confidentiality, integrity, and availability and is categorized as a remote code execution vulnerability.

The issue impacts Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. All installations of these Office suites are potentially vulnerable; no specific patch release numbers are listed, so any version of the mentioned products remains at risk until updated.

The CVSS score of 8.8 indicates a high severity flaw, and while the EPSS score is not available, the description states the vulnerability can be triggered over a network by an unauthorized attacker. The flaw is not currently listed in CISA’s KEV catalog, but the high CVSS implies a substantial risk of exploitation if the missing patch is not applied soon. An attacker would likely need access to a network channel that allows delivery of a malicious Excel file to the target system.