Microsoft Office 365 For Mac
Monthly
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).