An out‑of‑bounds read flaw exists in Microsoft Office Excel that allows an attacker who can cause the application to process an Excel workbook at a remote or local location to read memory that should not be exposed. The vulnerability, identified as a CWE‑125 failure to validate memory bounds, permits unauthorized disclosure of internal data such as credentials, documents or other sensitive content that resides in the application’s heap or stack areas.

The flaw impacts Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024. All current installations of these products should be considered vulnerable until the vendor publishes a security update that addresses CVE‑2026‑88175.

The CVSS score of 6.5 classifies the issue as moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to deliver a malicious or tampered Excel file to the victim’s system over a network or local file system, after which Excel will perform an out‑of‑bounds read during the file’s parsing stage, exposing memory contents to the attacker.