An out‑of‑bounds read in Microsoft Office Excel allows an unauthorized attacker to read memory contents and disclose them over a network. The flaw arises when the application processes certain Excel files, enabling data to be read beyond intended bounds, thereby leaking sensitive information the user may be handling. This directly jeopardises confidentiality of the data accessed by the user during the file handling process.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are affected. Exact version information is limited to the LTSC 2021 and LTSC 2024 releases; other Office for Enterprise and Mac channels may also include the vulnerability. All versions of the identified products should be reviewed for the presence of the issue.

The CVSS score of 6.5 indicates a medium severity impact. The EPSS score is not available, so the estimated likelihood of exploitation cannot be quantified. Microsoft does not list this vulnerability in its KEV catalog, implying no confirmed widespread exploitation yet. The flaw requires a victim to open a crafted Excel file, suggesting that it is primarily an insider or social engineering risk. Overall, the risk to an organization rises with the number of end‑users who may process potentially malicious documents.