CVE-2023-36897: Visual Studio Tools for Office Runtime Spoofing Vulnerability

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

The user would have to click on install to be compromised by the attacker.