An out‑of‑bounds read flaw in Microsoft Office Excel enables an attacker to read data beyond the intended buffer, which can expose sensitive information to anyone who can interact with the vulnerable instance. The flaw is classified as CWE‑125 and carries a CVSS score of 6.5, indicating moderate severity. The official Microsoft advisory states that the vulnerability can be exploited by an unauthorized attacker to disclose information over a network, but the precise exploitation method (e.g., file opening, macro execution) is not detailed, so the attack vector is inferred to involve interacting with a malicious Excel file or crafted content.

The issue affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, Microsoft Office LTSC for Mac 2021 and 2024, and Office Online Server. Specific version ranges are not enumerated in the advisory, so all releases of these products that include Office Excel should be considered at risk until a fix is applied.

With a CVSS score of 6.5 the vulnerability is moderate, and its EPSS is not available, so current exploit probability is unknown. The flaw is not listed in the CISA KEV catalog, indicating that no confirmed widespread exploitation has been reported yet. If a successful exploit occurs, it would result in the disclosure of confidential data but would not provide code execution or arbitrary command execution. The limited impact scope means that while the issue is serious, the risk level remains manageable pending remediation.