An out‑of‑bounds read flaw in Microsoft Office Excel enables an unauthorized attacker to read memory data that should not be accessible, potentially revealing sensitive information over the network. The vulnerability allows the attacker to extract data that should remain confidential, but the CVE does not state whether any user interaction is required beyond providing a malicious Excel file.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are affected. No specific version numbers are provided, so the issue applies to the current releases of these product lines.

The CVSS score of 6.5 places the vulnerability in the medium severity range. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network connection where an unauthorized attacker can supply a malicious Excel file that triggers an out‑of‑bounds read. It is inferred that the victim must open or otherwise process the malicious document, but the CVE description does not explicitly state the exact interaction required. Once processed, the program may leak sensitive data back to the attacker over the network.