A vulnerability in Microsoft Office Excel can expose sensitive system information to an unauthorized control sphere, enabling an attacker to learn confidential data over a network. This flaw is classified as CWE-497 and allows disclosure of details that should remain private.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server.

The CVSS score of 6.5 indicates moderate severity, and there is no EPSS score available to gauge current exploit likelihood. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Based on the description, it is inferred that the attack vector is remote via network exposure, with an attacker exploiting an otherwise legitimate Office environment to retrieve system information. The absence of an official workaround means that remediation primarily relies on applying vendor patches to close the exposure.