Microsoft Excel Cross-Site Scripting Vulnerability Allowing Information Disclosure

A cross-site scripting vulnerability has been identified in Microsoft Office Excel. This issue arises from improper input neutralization during web page generation, allowing an unauthorized attacker to disclose information over a network. The vulnerability affects Microsoft 365 Apps for Enterprise, both 32-bit and 64-bit versions.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure. An attacker could cause the Copilot Agent mode to exfiltrate data via unintended network egress, enabling a zero-click information disclosure attack.

Remediation

Users can download the security update for this vulnerability through the Microsoft Update Catalog. For Microsoft 365 Apps for Enterprise, security update details are available on the Office Security Releases page.