The flaw is an out‑of‑bounds read within Microsoft Office Excel, categorized as CWE‑125. An attacker who can trigger the read may obtain sensitive data that resides in memory or on disk and transmit it over a network, thereby compromising confidentiality. The description indicates that the attacker does not need privileged access and can read data that should be protected.

Microsoft products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific patch versions are listed, so any version within these product families that has not yet applied the latest update is considered vulnerable.

The CVSS score of 6.5 places the vulnerability in the medium severity range. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that exploitation is possible but not yet widely observed. The attack vector is likely remote or network‑based, inferred from the mention that information can be disclosed over a network. A malicious Excel document or a crafted file opened by the victim could trigger the out‑of‑bounds read and exfiltrate data, assuming the attacker has a way to deliver or entice the victim to open the document.