An out‑of‑bounds read flaw in Microsoft Office Excel allows an attacker with local access to the impacted system to read data that the process should not access. This bug manifests as a local information‑disclosure vulnerability classified as CWE‑125 and could expose sensitive configuration or user data stored on the machine.

Affected are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. The CVE lists the enterprise edition of the 365 apps and the long‑term servicing channel builds of the 2021 and 2024 Office suites, covering current 2026 releases.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, so there is no publicly reported prevalence of exploit attempts. The flaw requires local execution or a local user context, making the attack vector local. It is not listed in CISA’s KEV catalog, implying no known large‑scale exploitation.