This vulnerability provides a way for an Excel macro to run without generating the usual warning notice to the user. A malicious user could create a text file containing Excel macro commands, and embed commands in a spreadsheet that, if executed, would launch the macro without asking the user for permission. The vulnerability is limited in two chief ways. First, it does not provide any way for a malicious user to force the user to open the spreadsheet. Second, even if the user did open the spreadsheet, an affected macro could only execute if the user could be persuade to launch it.
Security is an important consideration when using macros.
By design, a running macro can take any action on a system that the user himself could take. Excel lets each user decide under what conditions macros will be allowed to run. Macros that have been digitally signed by someone the user trusts can run, but all other macros are prevented from running. Macros that have been digitally signed by someone the user trusts can run, but all others will generate a warning dialogue that asks for the user's permission before running. All macros are allowed to run without warning.