The EPSS score of 0.00352 on CVE-2026-68802 is essentially noise, while CVSS 5.5 rates it MEDIUM. That gap isn't a scoring anomaly — it's a structural blind spot in how exploitation probability models value information disclosure in high-value targets.
This out-of-bounds read in Excel discloses heap memory from process space. That's not a standalone attack — it's infrastructure for one. Heap layout disclosure defeats ASLR, making subsequent code execution reliable. When the attack surface is email-delivered .xlsx files (already past your perimeter through social engineering), this bug provides the reconnaissance layer attackers need for sandbox escape or privilege escalation. The 'local information disclosure' CVSS phrasing describes where the disclosure stays — within the Excel process memory — not that the attacker needs local credentials. Opening a weaponized file is the access vector; the OOB read does the rest.
The CVSS 5.5 rating reflects standalone disclosure, but the actual risk multiplies when this enables ASLR bypass in a kill chain. Microsoft's patch cadence on Office bugs suggests this was found through internal audit rather than active exploitation — which tempers the urgency slightly but doesn't change the blast radius: Excel runs with full user context, parses untrusted content by design, and occupies a force-multiplier position in enterprise attack chains.
Treat this as a high-priority patch regardless of the EPSS score. The model's training data counts successful RCE as exploitation events, not the disclosure primitives that enable it. That architectural choice produces predictably wrong outputs for this vulnerability class. If your patch prioritization leans on EPSS, manually elevate information disclosure bugs in document parsers — they represent the reconnaissance layer of the dominant attack pattern against Office targets, and the historical pattern shows these surface as routine MEDIUM issues, then surface months later in active campaigns.