The vulnerability is an improper access control flaw in Office for Android that allows an unauthorized attacker to execute local spoofing. This permits the attacker to impersonate legitimate content or users within the Office applications, potentially misleading users about the authenticity of documents or messages. The flaw could be leveraged to manipulate user interactions, leading to confusion, mistaken trust, or the transmission of incorrect information.

Microsoft Excel for Android, Microsoft PowerPoint for Android, and Microsoft Word for Android on Android devices are affected. No specific version numbers are listed, indicating that any installed build of these applications could be vulnerable until a patch is applied.

The CVSS score of 7.1 classifies this as a High severity issue, and the EPSS score is not available, meaning there is no publicly quantified exploitation probability yet. The vulnerability is not listed in CISA KEV catalog. Based on the description, the attack likely requires local device access; an attacker who can inject malicious input or trigger the application locally can exploit the access control defect to spoof user identities or content.