A critical out-of-bounds read vulnerability in Microsoft Office Excel exposes users to potential arbitrary code execution via malicious file processing.

This vulnerability is caused by an out-of-bounds read (CWE-125) within the Excel application. An attacker can exploit this flaw by enticing a user to open a specially crafted malicious file, which triggers the memory error and enables local code execution.

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk to organizational security. Successful exploitation grants an attacker the ability to execute code locally, which may lead to total system compromise, unauthorized data access, and potential lateral movement within the network. Because Excel is a ubiquitous tool for data processing, the risk of a user inadvertently opening a weaponized document is significant.

Immediate Action: Apply the relevant security updates provided by Microsoft through the official update guide at https://aka.ms/OfficeSecurityReleases to patch the affected software versions.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by Excel or unusual memory access violations occurring within the office suite.

Compensating Controls: Implement organizational policies that restrict the execution of macros and use protected view settings to prevent the automatic opening of untrusted or externally sourced files.

Public Exploit Available: No (exploit_available: false)

Given the high impact of this vulnerability, security teams should prioritize the deployment of the vendor-supplied patches across all workstations and servers running the affected versions of Microsoft Office. Ensure that automated update mechanisms are functioning correctly to minimize the window of exposure and reduce the risk of compromise through social engineering attacks involving malicious Excel files.