Microsoft’s Word RCE Alert: Don’t Be Fooled by the ‘Local’ CVSS Score

When Microsoft’s Security Response Center published an advisory for CVE-2026-20948, the header screamed urgency: “Microsoft Word Remote Code Execution Vulnerability.” Yet the accompanying CVSS vector string listed the attack vector as “Local” (AV:L). For many IT teams, that combination rang alarm bells — not about the vulnerability itself, but about a possible mislabel. How can a remote code execution (RCE) bug be assigned a local attack vector? The answer, buried in technical nuances, could mean the difference between a swift patch and a disastrous delay.

The Advisory at a Glance

CVE-2026-20948 affects Microsoft Word. The official Security Update Guide entry from Microsoft labels it an RCE, signaling that an attacker outside the victim’s network could potentially run arbitrary code on a targeted machine. The advisory’s FAQ directly addresses the apparent contradiction: according to the page, the word “Remote” in the title refers to the location of the attacker, while the actual exploitation occurs locally on the victim’s computer. In other words, a threat actor can deliver a booby-trapped document from afar, but the bug itself fires when Word processes that file on your PC.

The distinction isn’t just semantic. It shapes how risk is evaluated and, crucially, how patch urgency is decided in enterprises that lean on CVSS scores for automated triage.

The CVSS Logic Behind the Scenes

CVSS (Common Vulnerability Scoring System) is the de facto standard for measuring vulnerability severity. Its Attack Vector (AV) metric answers one precise question: where must the vulnerable component be running for exploitation to succeed? The four possible values — Network (N), Adjacent (A), Local (L), Physical (P) — form a scale of attacker accessibility. “Local” means the vulnerable code executes on the victim’s own machine, typically inside a user-mode application, regardless of how the malicious data arrived there.

For document-parsing flaws, the CVSS v3.1 specification states clearly: if a program like Word must open a file for the bug to trigger, AV is Local — even if that file arrived via email, cloud storage, or a web download. This guidance prevents scorers from inflating metrics by counting the delivery channel as part of the vulnerable component’s exposure. The CVSS framework draws a hard line between “remote delivery” and “network-reachable exploitation.”

Microsoft’s advisory for CVE-2026-20948 echoes this: “The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine.” So while an attacker can send a malicious .docx from anywhere in the world, the actual exploitation requires the target to open the file in Word. The CVSS vector accurately captures that mechanic.

The Exception That Changes Everything

There is a scenario where the Attack Vector flips to Network (AV:N). If a server-side component — like an email gateway that generates previews, Office Online Server, or a document-conversion service — parses user-supplied files without requiring local user interaction, the vulnerable code runs inside a network-facing process. In that case, exploitation can be triggered remotely by simply sending a malicious document to the server. For CVE-2026-20948, Microsoft’s advisory doesn’t explicitly call out server-side parsing risks, but security teams must investigate whether any of their own infrastructure performs such automated processing with Word libraries. If it does, the effective exposure becomes network-triggered, and the vulnerability should be treated with the highest urgency.

Who’s at Risk? From Home Users to Server Farms

The practical impact of CVE-2026-20948 varies by environment, but no one should dismiss it as minor.

Everyday Users

If you run Microsoft Word at home, this vulnerability means that a carefully crafted file — delivered through a phishing email, a cloud share, or even a compromised website download — could hijack your computer when you open it. The attack vector being “Local” doesn’t make it harder for criminals to reach you; it just reflects the reality that you must take the action of opening the file. With social engineering, that barrier is often trivial to overcome.

IT Administrators

For enterprise defenders, AV:L can be dangerously misleading. Because CVSS base scores use the Attack Vector in their formulas, a “Local” rating depresses the overall severity number compared to “Network.” An automated patch management system that sorts by CVSS score might place CVE-2026-20948 lower in the queue than a network-exploitable RCE. That’s a mistake. The ease of delivering Office documents at scale — phishing campaigns, shared network folders, supply-chain attachments — makes this vulnerability as weaponizable as many network bugs.

Developers and Service Operators

The hidden risk sits with server applications that integrate Word parsing. Common culprits include:

• Email gateways that generate message previews by converting attachments
• Web apps that allow document uploads and return thumbnails or text extracts
• Collaboration platforms with server-side rendering
• Document management systems that perform OCR or indexing using Word libraries

If your infrastructure uses any version of Word or the Office Web Apps to programmatically open files from untrusted sources, CVE-2026-20948 may be a network-accessible flaw in your context. Treat those servers as internet-facing and patch them immediately.

A History of Scoring Office Bugs: Similar Stories, Same Confusion

This isn’t the first time a Microsoft Office vulnerability has caused head-scratching over AV labels. CVE-2017-11882 (Equation Editor stack buffer overflow) and CVE-2021-40444 (MSHTML remote code execution) were both classified as “Remote Code Execution” in vendor headlines yet scored with AV:L in many CVSS assessments. In each case, the confusion stemmed from the same tension: vendor communication prioritizes attacker origin and critical impact, while CVSS demands a mechanistic look at the vulnerable component’s execution context.

Over the years, defenders have learned — sometimes painfully — to read past the headline. But the learning curve re-emerges with every high-profile Office bug. Industry groups like FIRST (the organization behind CVSS) have repeatedly clarified the scoring rules, yet the disconnect persists in operational security teams because CVSS scores feed directly into SIEM, SOAR, and patch management tools that make automated decisions based on numbers, not narrative.

The history lesson is clear: when an Office RCE appears with AV:L, apply the same patching urgency you would to a network-facing flaw on your most critical servers. The delivery mechanism is too easy, and the post-exploitation possibilities — ransomware, credential theft, lateral movement — remain devastating.

Immediate Steps for Defense

1. Patch Microsoft Word — Everywhere
Consult the Microsoft Security Update Guide for CVE-2026-20948 to identify the exact security updates for your Office versions. Deploy these patches to all endpoints, including any servers that might have Office installed for background processing. This is the definitive fix.

2. Harden Office Applications
Even after patching, reduce the attack surface:
- Enable Protected View for all files originating from the internet.
- Block unsigned macros by Group Policy and disable all macros if business requirements allow.
- Use Attack Surface Reduction (ASR) rules to prevent Office apps from launching child processes like cmd.exe, powershell.exe, or mshta.exe. The rule “Block Office applications from creating executable content” is particularly effective.

3. Lock Down Server-Side Processing
If you run any service that opens Word documents on behalf of users:
- Isolate those servers from the rest of the network and the internet as much as possible.
- Consider replacing native Word parsing with sandboxed or alternative libraries.
- Apply the patch to those servers first, since they may effectively be network-facing for this vulnerability.

4. Enhance Detection and Response
Post-exploitation behavior from Office bugs often follows predictable patterns. Configure your EDR and SIEM to alert on:
- winword.exe spawning cmd.exe, powershell.exe, regsvr32.exe, mshta.exe, or wscript.exe.
- Office processes loading unusual DLLs or making network connections to rare external IPs immediately after opening a document.
- File creation events showing suspicious documents arriving from external sources and then being opened by privileged accounts.

Sample detection logic for Splunk, Sentinel, or similar tools:

5. Train Users (Again)
Social engineering is still the primary delivery method. Remind users to hesitate before opening unexpected attachments or clicking on file links in emails, even if they appear to come from known contacts. Encourage checking with senders via a separate channel.

What’s Next for Vulnerability Scoring?

The CVE-2026-20948 episode highlights a long-standing communication gap. Microsoft’s approach — “Remote Code Execution” as a plain-language alarm — serves a purpose, but it clashes with automated scoring systems that drive patching cadences. As CVSS evolves (version 4.0 introduces new metrics like “Attack Requirements” and “Subsequent System Impact”), the hope is that scores will better convey real-world exploitability without relying on defenders to manually reconcile titles.

Until then, security teams must build their own internal guidance: “RCE in an Office title = patch immediately, regardless of vector.” Combining that rule with a thorough understanding of your document processing pipeline will keep you ahead of the next CVE-2026-XXXXX that inevitably arrives with a seemingly mild AV:L score.

CVE-2026-20948 is a potent reminder that in cybersecurity, labels can lie — not by malice, but by design. Read beyond the score, and act with the full picture in mind.