An out‑of‑bounds read flaw has been discovered in Microsoft Office Excel that lets an unauthorized entity read data from a victim system after processing a malicious file. The vulnerability stems from improper array bounds validation within the Excel engine, allowing an attacker to access memory locations beyond the intended target. The result is a loss of data confidentiality for any user who opens or processes a crafted workbook, potentially exposing sensitive corporate or personal information.

Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, are affected. The CVE entry does not specify a limited version range; therefore, any build of these products that has not yet been patched by Microsoft may be susceptible. Users should verify that their systems are running the latest cumulative updates available through Windows Update, Office 365 update channels, or the Microsoft Security Update Guide.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, but the description implies a network‑based attack vector, meaning a malicious actor could deliver a crafted Excel file over a network connection to the target machine. Although the CVE is not listed in the CISA KEV catalog and no publicly disclosed exploit is known, the flaw’s nature permits potential data exfiltration once a victim processes a malicious document, making it a credible threat especially for organizations with exposed office environments.