Microsoft Office Excel is vulnerable to a use‑after‑free flaw (CWE‑416) that permits an attacker to read sensitive data from memory and expose it over the network. The vulnerability can lead to exposure of confidential information within documents accessed by the affected Excel instance, potentially impacting the confidentiality of corporate data.

The flaw affects the macOS releases of Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021 for Mac, and Office LTSC 2024 for Mac. All users running these Windows or macOS Office suites may be at risk unless updated.

The CVSS score of 6.5 indicates a moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the overall exploitation likelihood is uncertain but the potential for remote information disclosure remains. The attack likely requires delivery of a crafted spreadsheet or macro via a network channel, which an attacker can initiate from a remote location. If exploited, the attacker could read process memory and transmit the data over the network to exfiltrate sensitive information.