The Microsoft Security Response Center labels the impact as remote code execution, while the CVSS vector describes the path to the vulnerable Office component. In practical terms, CVE-2026-63515 can permit code to run on a target Windows device in an Office process, but the vulnerable processing path is not a network-facing Office service such as a listener accepting hostile packets from the internet.
Microsoft’s wording that “Remote” refers to the attacker’s location is directionally understandable but technically incomplete. The clearer explanation is that an attacker can be remote from the victim and still induce a local Office component to process the malicious content or execute the relevant code path. The code runs on the victim’s machine; the attacker does not need to be physically present. CVSS, meanwhile, asks whether the vulnerable component itself is reached through the network stack. For an Office document parser or similar client-side component, the answer can be no even if the document first arrived by email, Teams, a cloud share, a web download, or removable media.
CVSS Attack Vector Measures the Vulnerable Path
The CVSS 3.1 specification maintained by FIRST defines Attack Vector as the context in which the vulnerable component can be exploited. Network-rated flaws are those in components bound to the network stack: a web server, an exposed RPC endpoint, a database listener, or another service that can be directly addressed across a network.
A Local rating does not automatically mean the attacker already has an interactive desktop session, administrative privileges, or physical possession of the PC. It means the vulnerable component is reached through local read, write, or execute capabilities rather than by directly sending traffic to that component over a network. In a client application, a malicious file can be delivered remotely and later opened, previewed, indexed, or otherwise handled by a local process.
FIRST’s own CVSS 3.1 scoring guidance uses document-processing vulnerabilities as the canonical example. A malicious Office document delivered through a website or a USB drive can still be scored AV:L when the Office application is the separate local component that reads the saved file. The delivery mechanism is not the same thing as the vulnerability’s attack vector.
That distinction is easy to miss in vulnerability dashboards because AV:N and AV:L look like simple shorthand for “remote” and “local.” They are not. AV:N says the vulnerable software can be attacked over a network connection; AV:L says exploitation must reach the vulnerable software through local execution or local data handling. Neither metric, by itself, answers whether a threat actor can send a weaponized file to a user from another country.
“Remote Code Execution” Describes the Result
The “remote code execution” label is principally about the security outcome: an attacker’s instructions may execute in the context of a process on another system. In Office cases, that typically means execution under the permissions of the person running the Office application, rather than automatic SYSTEM-level compromise.
That is why code execution flaws in desktop software have long been called RCE vulnerabilities even when they require a user to open content. Microsoft’s historical Office advisories used the same language for specially crafted files: code runs on the victim’s computer after Office processes attacker-controlled content. No network daemon needs to be exposed for that result to be serious.
“Arbitrary code execution,” or ACE, is sometimes the more precise phrase because it emphasizes what the flaw enables without inviting assumptions about the network route. It is not a different severity class and it does not imply that an attacker must already be local. It simply avoids the overloaded word remote.
For administrators, the important correction is this: CVE-2026-63515 should not be read as a classic local privilege-escalation flaw that is useful only after an intruder has established a foothold. A Local CVSS vector can cover a client-side execution bug that is used for initial access, provided an attacker can persuade a user or a local process to handle the malicious content. Conversely, it should not be read as an internet-scannable Office service vulnerability comparable to a critical Exchange, SharePoint, RDP, or SMB flaw.
Microsoft’s FAQ Leaves Important Operational Details Unanswered
Microsoft published CVE-2026-63515 on August 11, 2026, but the supplied advisory text does not identify the precise Office applications, versions, builds, update packages, CVSS base score, user-interaction requirement, or exploitability assessment. Those omissions matter more than the RCE-versus-Local terminology when IT teams decide what to patch first.
An Office-wide CVE title is not enough to determine exposure. Microsoft uses “Microsoft Office” for vulnerabilities that may affect only certain perpetual Office editions, Microsoft 365 Apps update channels, a particular Office shared component, or a narrower product such as Word, Excel, Outlook, or PowerPoint. The remediation path can also differ sharply between Click-to-Run Microsoft 365 installations and MSI-based Office editions.
The absence of a stated user-interaction value is particularly limiting. AV:L does not establish whether the victim must explicitly open a file, whether a preview or another automatic local handling path is sufficient, or whether an attacker who already has code execution can use the flaw for a more useful execution context. Those are separate CVSS and exploit-chain questions.
Microsoft’s concise explanation also blurs the difference between who launches the attack chain and where the vulnerable operation occurs. Saying that “an attacker or victim needs to execute code from the local machine” could lead readers to conclude that a remote attacker cannot practically exploit the flaw. The CVSS guidance says otherwise: a remote attacker can deliver malicious content, while the eventual exploitation of the local Office parser remains AV:L.
What Windows Administrators Should Take From CVE-2026-63515
The safe interpretation is that CVE-2026-63515 is a client-side Office code-execution issue whose exploitability depends on reaching a local Office execution or parsing path. It is not evidence that Office is accepting unauthenticated exploit traffic directly from the internet, and network segmentation alone is not a meaningful fix for affected endpoints.
Patch prioritization should therefore focus on systems that process Office content from outside the organization or from less-trusted internal sources: user workstations, shared virtual desktops, jump hosts with Office installed, document-processing systems, and high-value administrative endpoints. Email filtering, attachment detonation, file-type controls, Microsoft Defender Attack Surface Reduction rules, and least-privilege user accounts can reduce the likelihood or impact of a malicious-document chain, but they do not replace the security update once Microsoft identifies the affected products and packages.
The headline is not wrong, but it is easy to overread. CVE-2026-63515 is “remote code execution” because hostile code can execute on the victim’s device; it is AV:L because the vulnerable Office component is exploited through a local processing path rather than as a network service. That combination is normal for document-based client vulnerabilities—and it is precisely why calling it merely “local” would understate the risk.