Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to read memory contents over a network, potentially exposing sensitive information. The flaw is a classic buffer over-read (CWE‑126) that does not lead to code execution but can leak confidential data to the attacker. The vulnerability is triggered by specially crafted inputs processed by Excel which cause the program to read beyond the bounds of a buffer during a network operation.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Administrators should verify the exact build numbers against Microsoft’s advisory.

The CVSS base score of 6.5 classifies the issue as medium severity. The EPSS score is reported as < 1%, indicating a very low exploitation probability in the current landscape, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network‑based interaction with a vulnerable Excel instance, and no authentication or privilege escalation is required. Because the flaw permits disclosure of data rather than arbitrary code execution, the risk is primarily confidentiality loss, but the impact can be significant if the exposed data is sensitive.