Out‑of‑bounds read in Excel exposes internal memory contents to an adversary, enabling leakage of sensitive data such as passwords, configuration details or credentials. The flaw provides an information disclosure path without granting code execution or privilege escalation. The associated weakness is documented as CWE‑125 and the CVSS score is 6.5, indicating moderate severity.

The vulnerability impacts a broad range of Microsoft Office products: Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 2021 and Office 2024 for Windows, the long‑term servicing channel releases, and the corresponding Office 365 and Office LTSC editions for macOS.

The likely attack vector is delivering a crafted Excel file over a network to a user who opens it. Because the vulnerability is an out‑of‑bounds read, the attacker can read arbitrary data from memory. The EPSS score of <1% indicates a very low exploitation probability, and the CVSS score of 6.5 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog, and no local privileges or code execution are required for the exploit to succeed.