Improper access control in Microsoft Office Excel enables an unauthorized attacker to bypass a built‑in security feature when the application is run locally. This bypass can allow local users or malware that has local execution privileges to elevate privileges or execute malicious code that would normally be blocked by the security feature. The impact is a loss of integrity and confidentiality of data processed by or stored in affected Excel workbooks.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Both 32‑bit and 64‑bit Windows installations and macOS versions are affected; no specific version numbers are listed, indicating that all releases within the mentioned product lines are impacted.

With a CVSS score of 7.8 the vulnerability is high, and the EPSS score of less than 1% indicates a very low but nonzero probability of exploitation. It is not currently listed in the CISA KEV catalog. The likely attack vector is local, requiring access to a machine with an affected version of Excel; the attacker can supply a crafted workbook or command to bypass the security guard. Because the feature is bypassed locally, the risk is focused on end‑user workstations rather than remote denial of service.