A recently disclosed vulnerability in Microsoft Office, tracked as CVE-2026-45475, is raising eyebrows due to an apparent contradiction in its labeling. Microsoft classifies it as a Remote Code Execution (RCE) flaw, yet the Common Vulnerability Scoring System (CVSS) assigns it an Attack Vector of Local (AV:L). For security practitioners and IT admins, this discrepancy can lead to confusion during triage and patch prioritization. The reality, however, is that both the classification and the CVSS score are correct—once you understand the nuance of how CVSS defines “local.”

What Is CVE-2026-45475?

CVE-2026-45475 is a code execution vulnerability that resides in the way Microsoft Office handles certain file formats. An attacker can craft a malicious document, such as a Word DOCX or Excel XLSX file, that exploits a flaw in the application’s parsing engine. When a victim opens the file, the vulnerability allows arbitrary code to run with the same privileges as the logged-in user. The issue affects multiple Office versions, including Office 2019, Office 2021, and Microsoft 365 Apps for Enterprise, as well as Office for Mac.

Microsoft released a patch for CVE-2026-45475 on August 11, 2026, as part of its monthly security update cycle. The advisory rates the vulnerability as Important and confirms that exploitation requires user interaction. “In a file-based attack scenario, an attacker could host a specially crafted file designed to exploit the vulnerability and then convince a user to open it,” the advisory states. “The attacker would have no way to force the user to open the file.”

Despite the requirement for user interaction, the impact is severe. Successful exploitation grants an attacker the ability to install programs; view, change, or delete data; or create new accounts with full user rights. This is the classic profile of a post-exploitation foothold, making it a prime candidate for phishing campaigns and targeted attacks.

CVSS Score and Vector: AV:L Debunked

The CVSS v3.1 score for CVE-2026-45475 is 7.8, placing it in the High severity range. The vector string is:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Breaking this down:

  • AV:L (Attack Vector: Local) – The vulnerable component is not bound to the network stack; the attacker must either have physical access to the target system or rely on the victim to perform the unsafe action locally.
  • AC:L (Attack Complexity: Low) – No special conditions beyond opening the file are required for exploitation.
  • PR:N (Privileges Required: None) – The attacker does not need authenticated access before exploitation.
  • UI:R (User Interaction: Required) – The victim must open the malicious file.
  • S:U (Scope: Unchanged) – The exploited code runs within the same security context as Office.
  • C:H/I:H/A:H (Confidentiality, Integrity, Availability: High) – Total compromise of the system.

At first glance, “Local” seems at odds with “Remote Code Execution.” But CVSS defines AV:L as an attack that requires either physical presence or local execution of the vulnerable component—even if the attack initiation comes from a remote source. In CVE-2026-45475, the vulnerable code executes locally on the victim’s machine when they open a document. The attacker does not need to be on the same network segment or have an existing presence on the device. A phishing email with a malicious attachment from halfway across the world qualifies as a remote attack in the threat landscape, but the vulnerability’s technical exploitation vector remains local because the vulnerable software component is running locally.

Contrast this with a true network-based vulnerability (AV:N), such as a flaw in an exposed RDP service or a web application that can be triggered by a simple HTTP request. There, the vulnerable code resides on a remotely accessible service. For CVE-2026-45475, the Office application is not a network service; it is a local executable. The attack relies on the victim to bring the malicious file to the application. This distinction is crucial for vulnerability management: AV:L vulnerabilities often have slower exploitation timelines and can be mitigated with user awareness training and endpoint controls, whereas AV:N vulnerabilities demand immediate patching or network-layer mitigations.

Why the “Remote” in RCE Title Matters

Microsoft’s vulnerability titles use the term “Remote Code Execution” to indicate that an attacker who is remote from the victim can achieve code execution—regardless of the technical attack vector. This classification helps administrators quickly identify vulnerabilities that pose a risk of external actors gaining control of systems without prior physical access. For CVE-2026-45475, the attacker is remote (e.g., operating through email, cloud storage, or a malicious website), but the exploitation mechanism requires the victim to open a file locally. Therefore, Microsoft’s naming convention and CVSS’s vector are both internally consistent.

This labeling nuance is not unique to this CVE. Historical examples include many macro-based malware vulnerabilities and the infamous CVE-2017-11882 (Equation Editor memory corruption). Both were labeled RCE but carried AV:L vectors because the vulnerable component runs on the client side. Security teams that focus solely on the CVSS “Local” tag might mistakenly downplay the urgency, missing the fact that such vulnerabilities are routinely used in widespread phishing campaigns. CVE-2026-45475 demands the same level of urgency as most RCEs—immediate patching, user education, and attack surface reduction measures.

Real-World Attack Scenarios

The most likely exploitation path for CVE-2026-45475 is via email attachments or links. An attacker sends a targeted email containing a weaponized Word document. The email might spoof an internal department, such as HR or Finance, and use social engineering to prompt the recipient to open the file. Upon opening, the document triggers the vulnerability, drops a second-stage payload (often a downloader or ransomware), and begins lateral movement.

Another vector is through malicious Excel files shared via SharePoint or OneDrive. If an organization allows external file sharing, an attacker could upload a boobytrapped spreadsheet to a shared folder and notify users via a collaborating email. Because the file originates from a cloud service that users trust, the phishing attempt is more convincing.

Web-based attacks are also possible. An attacker hosts a malicious DOCX on a compromised website and uses an iframe or a redirect to force a download. While browsers like Edge and Chrome have enhanced protections that flag or block such downloads, determined attackers can bypass these by embedding the file in a legitimate-looking archive or by using file-less techniques.

In all cases, the vulnerability is triggered on the endpoint, and no external network access is needed once the file is delivered. This aligns with the AV:L designation: the attack is completed locally, even though it originated remotely.

Mitigation and Response

Microsoft’s security update for CVE-2026-45475 (KB5048925 for supported versions) patches the underlying parsing flaw. All systems running affected Office versions should apply this update immediately. Because the vulnerability has been publicly disclosed and proof-of-concept code is likely to emerge within days, delaying patching increases the risk of compromise.

For environments where immediate patching is not feasible, Microsoft recommends the following workarounds:

  • Disable macros in Office documents – While this CVE does not rely solely on macros, disabling active content reduces the attack surface.
  • Use Application Guard for Office – This feature opens untrusted files in a virtualized sandbox, preventing exploitation of the host system.
  • Configure Attack Surface Reduction rules – Enable “Block Office applications from creating executable content” and similar rules.
  • Implement Protected View – Ensure that files from the internet open in read-only mode with risky features disabled.

User training remains a critical layer of defense. Phishing simulations that teach employees to recognize suspicious attachments can reduce the likelihood of successful exploitation. In high-security environments, consider blocking inbound .DOCX and .XLSX files via email gateways and forcing the use of alternative document formats.

The Bigger Picture: CVSS Literacy in Patch Management

CVE-2026-45475 underscores a common pitfall in vulnerability management: over-reliance on a single CVSS metric without context. The Attack Vector field is just one of eight base metrics; the overall score, temporal metrics, and environmental metrics must also be considered. An AV:L vulnerability with a high base score, no privileges required, and user interaction demanded typically scores between 7.0 and 8.0—solidly in the High range. This should trigger the same response as many AV:N vulnerabilities, especially if the affected software is widely deployed and frequently targeted.

Security teams should complement CVSS scores with threat intelligence. For example, a quick check of the Exploit Prediction Scoring System (EPSS) might show a significant probability of exploitation within 30 days for a client-side Office vulnerability. When such data is available, it should inform patching timelines.

Organizations that treat AV:L as “non-urgent” without examining the score’s other components and real-world attack trends risk leaving themselves exposed to the same vectors that have fueled ransomware outbreaks for years. CVE-2026-45475 is a timely reminder that “remote” and “local” are not mutually exclusive in modern attack chains.

Conclusion

CVE-2026-45475 is a textbook example of the interplay between vulnerability nomenclature and scoring standards. Microsoft’s “Remote Code Execution” label accurately reflects that an attacker can operate from a distance, while CVSS’s AV:L correctly identifies that the vulnerable code is executed locally. Both perspectives are essential for a complete risk assessment.

Administrators should not be deterred by the “Local” tag. This vulnerability carries a CVSS 7.8 rating, is trivial to exploit once a user opens a malicious file, and has high impact across all CIA dimensions. The patch released on August 11, 2026, must be prioritized, and additional mitigations like user education and endpoint hardening should be layered on top.

Ultimately, CVE-2026-45475 reinforces the need for a holistic approach to vulnerability management—one that combines CVSS data, threat intelligence, asset criticality, and human factors to drive effective security decisions.