A security analyst is scoring a newly disclosed vulnerability in a document viewer. Exploitation only succeeds if a victim opens a malicious file that is emailed to them; the code will not run on its own. Which CVSS base metric value most accurately captures this condition?