The vulnerability exists in the way Microsoft 's Visual Basic for Applications checks document properties passed to it when a document is opened .