An out-of-bounds read flaw in Microsoft Office Excel permits an unauthorized attacker to read data from memory that should not be accessible, potentially revealing sensitive information. This flaw is a type of memory safety vulnerability identified as CWE-125 and results in disclosure rather than code execution or denial of service. The attack can expose data that an Excel session holds, which may include credentials, documents, or other confidential material.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. All versions of these products that do not incorporate the latest security update are susceptible to the flaw.

With a CVSS score of 6.5, the severity is moderate. The EPSS score is not available, indicating limited publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves sending a specially crafted Excel file to a target over a network; the attacker would need to persuade the user to open or the application to read the file. The impact is restricted to unauthorized disclosure of information but could be leveraged further if discovered by a threat actor.