This vulnerability is an out‑of‑bounds read that occurs within Microsoft Office Excel. An attacker who can exploit the flaw can read portions of memory that the process manages, resulting in the disclosure of sensitive information over a network to an unauthorized party. The payload does not modify data, but the leakage of confidential data can compromise privacy and confidentiality.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. All current installations of these products are potentially vulnerable unless patched.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, so the likelihood of exploitation in the wild is unknown; the vulnerability is not listed in CISA’s known exploited vulnerability catalog. The description indicates that the data can be disclosed over a network, implying that a network‑based attacker could trigger the read, but specific conditions or user interaction are not detailed. Until additional exploitation information is released, the risk remains moderate with manual mitigation as a priority.