Microsoft this month released a security update that patches CVE-2026-20952, an Office vulnerability that perfectly captures a maddening contradiction in cybersecurity alerts. The advisory’s headline blares Remote Code Execution — the kind of warning that makes IT departments drop everything. But scan the technical CVSS vector and you’ll see Attack Vector: Local (AV:L). It looks like a mistake. It’s not. It’s a deliberate, if counterintuitive, part of how the industry communicates risk, and misunderstanding it could lead your organization to leave a critical gap wide open.

What’s really going on with CVE-2026-20952

The vulnerability itself is a classic file-parsing bug inside Microsoft Office. An attacker crafts a malicious document — a Word file, an Excel spreadsheet, a Visio diagram — and delivers it to the target, typically through a phishing email or a compromised file share. When the victim opens or previews the file, the flawed code inside Office triggers a memory corruption, type confusion, or similar low‑level error. Successful exploitation lets the attacker run arbitrary code with the same privileges as the logged‑in user, meaning a standard user account can be fully owned.

Microsoft’s own advisory note explains the headline: “The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.” In other words, the attacker can be sitting in a coffee shop halfway around the world when they send the booby‑trapped file, but the vulnerable code executes on your desktop when you double‑click it. That’s the heart of the Remote Code Execution label — the origin of the threat is remote, even though the trigger is local.

The CVSS Attack Vector, on the other hand, asks a narrower question: “Where must the vulnerable component run when the exploit fires?” Because it’s the Office application on your PC that parses the file and gets compromised, the vector is scored Local. The file arrived over the network, yes, but CVSS deliberately avoids counting that distribution step a second time; doing so would inflate scores and rob AV:N of its meaning for truly network‑facing services.

Why a ‘local’ attack doesn’t stay local

For the average Windows user at home, the takeaway is stark: opening that innocent‑looking invoice or resume attachment can hand over control of your PC in seconds. No macros, no enabling editing — just an unpatched Office app and a bad decision on what to double‑click. In the enterprise, the blast radius multiplies. A single email campaign with a malicious Office file can pivot into dozens of compromised workstations, and once an attacker has a foothold, ransomware or lateral movement often follows.

There’s an even nastier wrinkle that many organisations overlook. If your environment runs server‑side document processors — Exchange transport agents that scan attachments, SharePoint document previews, Office Online Server, mail gateway scanners — these components often parse the very same Office file formats. When they do, the vulnerable code can run in a network‑facing context, effectively converting that AV:L flaw into a true AV:N exploit. Microsoft’s CVSS guidance explicitly warns about this: if a file‑parsing bug is reachable by a network service without a local user opening the file, the correct Attack Vector becomes Network. For CVE-2026-20952, the default vector is Local, but server‑side parsers change the calculus entirely. If you’re running Exchange, SharePoint, or any document‑preview service, patching them becomes your absolute priority.

How vulnerability scoring keeps tripping us up

This isn’t a new argument. The CVSS standard, maintained by the Forum of Incident Response and Security Teams (FIRST), has long held that Attack Vector should describe the vulnerable component’s execution context, not the delivery method. The canonical example in the CVSS user guide is a document‑parsing vulnerability: because the vulnerable code is not an always‑on network service, AV:L is correct, even if the file arrived via email. Meanwhile, the CVE program and vendors like Microsoft use the title to signal worst‑case impact and attacker origin. “Remote Code Execution” is a high‑signal phrase that gets defenders to act, while the CVSS vector supplies the granular exploit mechanics.

The mismatch has real‑world consequences. Automated vulnerability prioritisation tools often ingest only the CVSS base score or the vector string. When they see AV:L and User Interaction Required (UI:R), they might downgrade the issue as minor — below a 7.0? Move to next sprint. But an Office RCE with AV:L and UI:R can be exploited at massive scale through social engineering, and if a server‑side parser is exposed, the practical risk jumps to critical. Organisations that don’t read the full advisory or understand this semantic divide risk leaving a back door open because a spreadsheet told them it was “local.”

Your to-do list: From patching to detection

  1. Patch now, patch everything. Install the latest Office security updates immediately. For enterprises, push via Microsoft Update, WSUS, or Microsoft Endpoint Configuration Manager. Check the MSRC advisory for your specific Office version and any server components. Don’t forget standalone installations and third‑party tools that embed Office libraries.
  2. Hunt down server‑side parsers. Inventory any service that touches Office files: Exchange transport agents, SharePoint, Office Online Server, mail gateway filters, CMS preview engines, even some SIEM tools that extract text from attachments. Escalate these to the top of your patching list — they can turn a user‑dependent exploit into a network‑level attack.
  3. Harden endpoints. Enforce Protected View. Block macros from the internet. Enable the Attack Surface Reduction rule “Block all Office applications from creating child processes” (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A). Use AppLocker or Windows Defender Application Control to restrict which executables Office can spawn.
  4. Tune detection. Watch for Office processes (winword.exe, excel.exe, powerpnt.exe, etc.) launching unexpected children: cmd.exe, powershell.exe, mshta.exe, wscript.exe, or rundll32.exe. Correlate with email delivery logs. Set up alerts for suspicious outbound connections shortly after a document is opened.
  5. Remind users, again. No amount of security software can stop a user who opens an attachment from a stranger. Run targeted phishing simulations and make it easy to report suspicious emails.

The big picture

CVE-2026-20952 isn’t an anomaly; it’s the latest in a long line of Office parsing bugs that wear a “local” costume while wielding remote‑level impact. The industry is unlikely to scrap the dual‑language system anytime soon — the CVE title serves crisis communication, and the CVSS vector serves machine‑readable rigour. For defenders, the only sane path is to treat any RCE‑labelled advisory as urgent, no matter what the Attack Vector says, and to scrutinise your environment for those pivot points that ratchet up the exposure. Patch, harden, detect, repeat — and never let a “local” label make you look the other way.