# Excel for Mac SYLK files auto-run XLM macros

Published: 2026-08-02 · Severity: low
Canonical: https://vorant.io/reports/a282e11c-72c8-5bb5-b2cd-92430d7f8f15/excel-for-mac-sylk-files-auto-run-xlm-macros

> SYLK (.slk) files auto-execute XLM macros in fully-patched Excel 2016/2019 for macOS even with the strictest macro setting enabled, enabling silent code execution.

Researchers at Objective-See revisited a technique originally disclosed by Pieter Ceelen and Stan Hegt (Outflank) at DerbyCon 2018, which showed that legacy SYLK (.slk) files opened by Microsoft Excel for Mac auto-execute embedded XLM macros without any prompt, even when the 'Disable all macros without notification' setting is enabled. While the original finding was dismissed by Microsoft as affecting only unsupported Office 2011, Objective-See demonstrates the flaw persists in fully-patched Excel 2016 and 2019 on macOS, corroborated by CERT/CC vulnerability note VU#125336. The team built a proof-of-concept SYLK file that leverages the XLM CALL function to invoke libc.dylib's system() function and launch Calculator.app, confirming that macOS registers Excel as the default handler for .slk files via its Info.plist CFBundleDocumentTypes declaration, causing automatic, silent execution upon double-click — even for files downloaded from the internet.

Despite achieving proof-of-concept code execution, the researchers note that real-world exploitation is significantly constrained by macOS security architecture. Excel operates within Apple's app sandbox (com.apple.security.app-sandbox), restricting the macro's spawned processes from accessing user files or installing persistent malware. On macOS Catalina, additional defenses — enforced quarantine checks regardless of execution method, and mandatory code notarization for compiled binaries — further reduce the practical impact, since quarantined or non-notarized code will be blocked even if sandbox escape is achieved.

The post is primarily an analytical deep-dive rather than a report of active exploitation; no in-the-wild campaign or threat actor is described. The authors recommend administrators set Office macro settings to 'Disable all macros with notification' and, per CERT guidance, block SYLK (.slk) file attachments at email and web gateways to mitigate the underlying vulnerability class.

Source reporting: https://objective-see.org/blog/blog_0x50.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a282e11c-72c8-5bb5-b2cd-92430d7f8f15/excel-for-mac-sylk-files-auto-run-xlm-macros.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup