Microsoft Office Security Feature Bypass Vulnerability

According to the CVSS metric, the attack vector is local (AV:L) but no privileges are required (PR:N) and user interaction is required (UI:R). How could an attacker exploit this security feature bypass vulnerability?
The attack itself is carried out locally by a user with authentication to the targeted system. An attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.

Security updates
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5344.1000 — https://support.microsoft.com/kb/5002112
15.0.5467.1000 — https://support.microsoft.com/kb/5002121