Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.
CWE-502