This vulnerability stems from Microsoft Office's reliance on untrusted inputs in a security decision, enabling an unauthorized attacker to bypass a security feature locally. The bypass removes a key protection check that normally enforces policies on document handling or macro execution, potentially allowing the execution of malicious code or the loading of untrusted content. The weakness is categorized as CWE‑807, implicating improper validation of internal data inputs.

Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are affected. The vulnerability applies to all installed versions of these products where the related feature is enabled. No specific sub‑release details are provided.

The CVSS base score of 7.8 classifies this as High risk, and an EPSS of 11% indicates a relatively high probability of exploitation. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, underscoring real‑world prioritization. Likely attack vectors involve local execution of a crafted Office document or file from an untrusted source, after which the attacker can bypass the security feature and execute code. The exploit does not require network privileges and can be performed by users with local access, making it a significant concern in environments with unrestricted Office usage.