The CVSS 7.8 on this Excel out-of-bounds read deserves your attention, but not for the reason you might think. The score itself is almost irrelevant—what matters is what happens AFTER successful exploitation, and that's where this vulnerability has teeth that the CVSS vector completely obscures.
When Microsoft assigns 'local code execution' language to an out-of-bounds read, they're signaling their exploit development team confirmed a concrete escalation chain, not just theorizing one. That's meaningful context the scoring model refuses to encode. But the downstream blast radius is what should actually drive your prioritization: an attacker with local code exec on an Excel instance in an enterprise environment isn't stopping at the endpoint. That machine likely holds OAuth tokens for SharePoint, Teams, and integrated SaaS workflows. The pivot from a finance analyst's laptop to lateral access across the M365 tenant—email archives, SharePoint repos, Teams data—is documented, direct, and requires no additional zero-day. CVSS models the exploit, not the cascade.
The EPSS at 0.00332 tells you something the severity score obscures: reliable weaponization is complex, which buys you breathing room. But that low probability reflects the narrowness of the initial exploitability window, not the breadth of what happens after someone clears that bar. The more dangerous pattern is defenders who, having learned to distrust HIGH ratings from past 'over-scoring,' systematically under-respond to precisely the vulnerabilities attackers chain in high-value targeting.
There's also a sediment-layer question worth asking: an out-of-bounds read in Excel's file format parsing doesn't surface in isolation. It surfaces in legacy parsing logic, deprecated feature handlers, and code paths handling legacy .xls compatibility that nobody has touched in years. That code is entropy—maintained just enough to not crash, reviewed just enough to pass regression, but fundamentally unexamined. The OOB read you see is the one that got past whatever minimal fuzzing runs on legacy code. The question isn't just what an attacker can do with this foothold; it's what else is living in that same forgotten parsing stack that hasn't been found yet.
Treat this as patch-on-next-cycle priority with standard SLA—not emergency response. But build the M365 token hygiene and endpoint isolation assumptions into your detection engineering, because the blast radius of a successful exploit is far broader than the CVSS score will ever tell you.