The vulnerability represents a protection mechanism failure in Microsoft Office Excel that enables an attacker without proper authorization to bypass a built‑in security feature when operating locally. The weakness, classified as CWE‑693, means that the application’s security controls are not adequately enforced, allowing the attacker to override or circumvent the control in question. Although the impact is limited to the local context of the affected machine, bypassing a security feature can open the door for further malicious activity such as executing unauthorized code or modifying protected documents.

Microsoft Office products across Windows and macOS are affected. Specifically, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are listed as impacted by this exploit.

The CVSS v3.1 score of 3.3 indicates a low severity overall and the EPSS score is currently not available. The vulnerability is not listed in the CISA KEV catalog. As it is a local issue, the attacker must have local access or the opportunity to act from within the user session. While the likelihood of a remote exploitation is low, the vulnerability still requires remediation because it nullifies a security control that could otherwise prevent further compromise within the environment.