Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. The flaw enables a malicious user with local access to craft or modify content that the Office suite will treat as trusted, effectively deceiving the user.

Affected products include Microsoft Excel for Android, Microsoft Word for Android, and the Office LTSC editions for macOS released in 2021 and 2024. No specific versions are listed, so all current installed copies of these applications are potentially vulnerable.

The CVSS score of 7.7 categorizes the vulnerability as high severity, indicating significant risk if exploited. The EPSS score of 0.00042 (<1%) suggests a very low likelihood of exploitation, and it is not listed in CISA’s KEV catalog, implying there have been no widely known attacks. The likely attack vector is local; an attacker would need local or physical access to a device running the affected Office version to create or modify files that trigger the spoofing behavior. If successful, the attacker could manipulate the appearance or authenticity of documents, deceiving users.