Those are separate parts of the same attack. The attacker may be somewhere else, deliver a booby-trapped document through email, a download, a shared workspace, or another transfer method, and persuade a user to process it. But Word’s vulnerable parser runs on the victim’s device, handling a file that is already available to the local system. Under CVSS rules, that is a Local attack vector.
Microsoft addresses the apparent contradiction in its FAQ, saying that “Remote” in the title refers to the attacker’s location, while the exploit itself is carried out locally. That explanation is directionally correct, but it compresses two distinct security terms into one sentence and leaves room for an operationally dangerous misunderstanding: AV:L does not mean the attacker must already have an interactive local login to the target PC.
CVSS Scores the Route Into Word, Not the Attack Campaign
The CVSS Attack Vector metric is often read as a plain-English statement about where an attacker sits. It is more precise than that. It measures the conditions required to exploit the vulnerable component — in this case, Word — rather than every step an attacker might take to get a malicious file in front of that component.
FIRST, the organization that maintains CVSS, explicitly uses the browser-to-Office-document sequence as the defining Local example. If a browser downloads a malicious Office file, saves it to disk, and then starts a vulnerable Office application that reads the saved file, FIRST says the Office vulnerability should receive AV:L. The network delivered the file, but the component being exploited is Word reading a local document.
That is the cleanest way to read CVE-2026-63518:
- An attacker can distribute a malicious Word document remotely.
- The file reaches or is saved to the victim’s Windows device.
- Word locally parses or otherwise processes that content.
- The flaw enables attacker-controlled code to execute in Word’s security context.
The network delivery mechanism is real, and it can make an attack scalable. It is simply not what CVSS’s Attack Vector field is scoring. A Word document exploit is fundamentally different from a vulnerability in a network service such as an exposed web server, where the vulnerable application itself receives and processes an attacker’s request over TCP/IP. That latter category normally earns AV:N, for Network.
Microsoft’s own choice of “Remote Code Execution” as the impact label follows long-standing industry usage. The term describes an attacker achieving execution on a machine they do not control; it does not promise that the vulnerable software exposes a remotely reachable listening service.
“Remote Code Execution” Describes the Outcome
The key distinction is between exploit access and exploit impact.
A Local attack vector answers: “Where must the vulnerable program be reached or supplied with malicious input?” For CVE-2026-63518, the answer is on the Windows endpoint, through Word’s local handling of a document.
Remote code execution answers: “What can the attacker make happen after successful exploitation?” The answer is code execution on the victim’s system, potentially with the rights of the user running Word. In traditional Office threat reporting, that is still called RCE because the malicious code is selected by a remote adversary and executed on a separate victim system.
“Arbitrary code execution,” or ACE, is sometimes used interchangeably with RCE. It can be a useful description of the technical capability, but it does not resolve the CVSS question. An ACE flaw can be local, network-reachable, adjacent-network reachable, or physically reachable. The meaningful detail is what precondition exists before the malicious code can run.
For Word, that precondition is usually document processing. The user may open a file received through a phishing email, access a file from a cloud-sync folder, or otherwise cause Word to load attacker-controlled content. An attacker who has already gained a foothold on a PC could also potentially place the file locally, but that is not the only plausible delivery path and should not be assumed from AV:L alone.
Microsoft’s Wording Is Serviceable, but It Is Not CVSS Terminology
Microsoft’s FAQ says the attacker or victim needs to execute code from the local machine to exploit the vulnerability. For an administrator deciding patch priority, the important practical translation is simpler: the vulnerable code path is not an Internet-facing Word service. The malicious document must be processed by Word on the endpoint.
The phrase “the word Remote in the title refers to the location of the attacker” is a reasonable shorthand for end users, but it does not map perfectly to the CVSS specification. CVSS itself frames Attack Vector around the context in which exploitation of the vulnerable component is possible. In the Word case, the attacker can be remote while the attack vector remains Local because a saved document crosses a boundary before Word processes it.
FIRST’s current CVSS examples make the point even more directly. Its example of a Microsoft Word remote-code-execution vulnerability carries AV:L, because the malicious document must be on the local disk. The example also describes an attacker sending the file and convincing a user to open it. That is the same model Microsoft is describing for CVE-2026-63518.
So there is no scoring discrepancy to “fix.” The title and vector answer different questions:
| Security label | What it says about CVE-2026-63518 |
|---|---|
| Remote Code Execution | Successful exploitation can make Word execute attacker-controlled code on the victim’s computer. |
| Attack Vector: Local | Word must process the malicious input locally on the victim’s endpoint rather than receive an exploit directly through a network-facing Word service. |
| User-mediated document delivery | A remote attacker can still deliver the lure or file through ordinary remote channels before local processing occurs. |
The term local therefore should not be treated as a reason to dismiss the advisory as irrelevant to phishing or document-based intrusion risk.
What Windows and Office Administrators Should Take From This
For enterprise patching, CVE-2026-63518 belongs in the document-attack category, not the “already-compromised machine only” category. Its risk depends less on whether Word is exposed to the Internet — it generally is not — and more on whether users receive untrusted documents and whether their endpoint controls stop, isolate, or contain malicious Office content before Word reaches the vulnerable path.
Microsoft’s advisory was published as part of the August 11, 2026 security release. Administrators should use the MSRC Security Update Guide’s affected-product table to identify the applicable Microsoft 365 Apps, Office LTSC, and perpetual Office updates in their environment, then verify deployment through their normal update-management tooling. The supplied advisory material does not establish a universal KB number or a single affected build, so treating one Office update package as sufficient across every channel and product family would be a mistake.
The advisory also should not be read as proof of active exploitation. Microsoft’s FAQ excerpt explains the terminology, but it does not, by itself, establish that attackers are using CVE-2026-63518 in the wild, identify a public proof of concept, or specify a particular delivery method. Those omissions matter: they separate a patched document-parsing flaw from a confirmed active campaign.
Endpoint controls remain relevant while patches are rolling out. Organizations should preserve Mark of the Web protections, keep Office macro and application-control policies intact, maintain attachment filtering, and investigate Word crashes or unusual child processes spawned by Office applications. Those measures reduce exposure to document-driven attacks broadly, but they are not substitutes for installing the security update.
The Practical Reading: Local Parsing, Remote Consequences
CVE-2026-63518 is best understood as a locally triggered Word vulnerability that can deliver remotely directed code execution. The attacker may never log in to the victim’s PC, and Word does not need to be listening on the network. The attacker’s task is to get malicious document content onto the endpoint and into Word’s processing path.
That is why “Remote Code Execution” and AV:L can coexist without contradiction. The CVSS vector tells defenders where the flaw fires; the RCE title tells them what an attacker can gain if it does. For Windows and Office administrators, the consequence is straightforward: treat the August 11 Word security update as protection against a document-based endpoint compromise path, not as a network-service patch that can wait because Word is not Internet-facing.