A flaw in Microsoft Office Excel enables an attacker with local access to perform an out-of-bounds read, which can expose data in the process memory. The vulnerability is a classic memory safety problem and is categorized as CWE-125. An attacker could read uninitialized or adjacent memory regions, potentially revealing sensitive information that the user normally has not privileges to see. This leads to a confidentiality breach without affecting integrity or availability directly.

Affected versions include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The vulnerability is present in all listed builds before the Microsoft Office update that addresses CVE‑2026‑85875.

The CVSS score of 5.5 indicates moderate risk; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to run malicious code on the compromised machine. Because the flaw allows reading of arbitrary memory, the impact is limited to local information disclosure unless additional malicious code is executed. Risk is elevated only when a user runs untrusted documents or interacts with untrusted content. Given the lack of known exploitation in the wild and the moderate CVSS score, the vulnerability remains a security concern but is unlikely to be widely abused.