The vulnerability is an out‑of‑bounds read in Microsoft Office Excel that permits an attacker to read data beyond the intended memory limits. This flaw can lead to disclosure of sensitive information that may reside on the same system or in transit, thereby compromising confidentiality. The weakness is a classic memory corruption issue classified as CWE-125.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. All versions of these products are vulnerable; no specific sub‑version restrictions are listed.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not yet widely exploited in the wild. The likely attack vector is a network‑based exploitation where an attacker can trigger the out‑of‑bounds read from a remote connection to Excel, potentially during file opening or through a crafted document. No additional conditions or privileges are described in the data.