Out‑of‑bounds read issues in Microsoft Office Excel enable an attacker who can supply a malicious workbook or otherwise trigger the vulnerability to read beyond a memory buffer, leaking data that may be sensitive. The impact is a compromise of confidentiality, as an unauthorized party can view information that should not be publicly exposed.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are affected. No specific version numbers are provided, so all builds of these suites that contain the vulnerable component are potentially impacted.

The CVSS score is 6.5, indicating a moderate severity vulnerability. The EPSS is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need to deliver a crafted Excel file or otherwise interact with the vulnerable component, suggesting the attack vector is likely local or remote file execution. While exploitation requires the victim to open or process a malicious file, the potential for widespread information leakage warrants close attention.