The vulnerability is a buffer over-read in Microsoft Office Excel that can expose sensitive data to an unauthorized attacker over a network. This weakness, identified as CWE-126 and CWE-191, allows the attacker to read memory beyond the intended bounds and consequently obtain content from other parts of the application or system. The primary impact is the disclosure of confidential information without modification or denial of service.

Affected are Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Version details are not enumerated beyond the product families, but any instances running these releases are potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is unavailable, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based exploitation where a malicious file or attachment is opened or processed by Excel, possibly triggering a buffer over-read. No additional prerequisites are specified.