The Security Update Guide’s wording is therefore imprecise only if readers interpret “remote” in the everyday network-administration sense of “reachable over the network.” CVE-2026-65657 is not, on the information Microsoft has published, a remotely reachable Office service flaw such as an unauthenticated bug in an internet-facing server. The Local rating means the vulnerable component must process malicious content through a local path on the affected PC. That is entirely compatible with an attacker delivering that content from afar, including by email, cloud storage, a download link, Teams, or a file share.
The most important correction to the explanation attached to the advisory is this: “remote” does not refer to the attacker’s location. It refers to the ability to execute attacker-controlled code in another security context. The target computer is where the code runs; the attacker may be across the internet, on the same corporate network, or standing beside the machine.
CVSS Measures the Exploit Path, Not the Marketing Name
CVSS Attack Vector answers a narrow question: what access path does the attacker need to reach the vulnerable component? It does not classify the resulting impact as “local code execution” or “remote code execution.”
The FIRST organization, which maintains the CVSS standard, is unusually explicit about this distinction. Its CVSS v3.1 guidance says a document-parsing vulnerability should generally receive an AV:L rating when exploitation does not depend on the network stack, even if the malicious document was delivered by a web link or a USB drive. It further gives the browser-to-Office example: if a browser downloads a hostile Office document to disk and Office later opens it, the Office flaw is Local because Office is processing a local file rather than accepting and parsing network traffic itself.
That describes the conceptual category CVE-2026-65657 belongs to. The vulnerable code is in Microsoft Office, and the trigger is the local handling of attacker-controlled content. The transport mechanism can be remote, but the vulnerability’s own attack surface is not a listening TCP port, an exposed RPC interface, or a web endpoint.
A remotely exploitable network flaw would receive AV:N when the vulnerable component itself accepts malicious input from the network. A defect in an Office document parser does not become AV:N merely because the attacker emails a document to a user. Email is delivery. Opening or previewing the content is the exploit path.
This is a crucial operational distinction for security teams. An AV:L Office CVE does not create an internet-wide scanning opportunity in the way an unauthenticated VPN, Exchange, SMB, or RDP vulnerability can. There is no basis in Microsoft’s advisory to treat CVE-2026-65657 as a wormable Office issue or as a reason to hunt for exposed Office ports.
“Remote Code Execution” Describes the Result
Microsoft has long used “Remote Code Execution Vulnerability” as the impact category for Office flaws where malicious documents can make Office execute code supplied by an attacker. Older Microsoft Office bulletins used the same terminology for vulnerabilities requiring a user to open a specially crafted file, often after receiving it in an email message.
The outcome is what earns the RCE label: code runs under the rights of the Office process and, in the typical desktop case, under the rights of the signed-in user. If the user is a standard user, the attacker starts with that user’s permissions; if the user has local administrator rights, the potential damage is substantially greater. The CVE title does not establish that exploitation automatically grants SYSTEM privileges, bypasses application controls, or survives a reboot. Those would require separate technical details or a chained vulnerability.
“Arbitrary code execution” and “remote code execution” are often used loosely and sometimes interchangeably in security reporting, but they answer different questions. Arbitrary code execution emphasizes that the attacker can make the vulnerable process execute chosen instructions. Remote code execution has historically been Microsoft’s impact label for a vulnerability that lets an attacker achieve code execution on a victim system. Neither label, by itself, tells an administrator whether the CVSS Attack Vector is Network, Adjacent, Local, or Physical.
Calling CVE-2026-65657 “local code execution” would create a different kind of confusion. In Windows security discussions, that phrase frequently suggests a flaw usable only after an attacker already has an interactive account, shell, or physical presence on the target machine. An Office file-parsing flaw can require local processing while still being the opening move in a remote social-engineering campaign.
A Remote Delivery Can Still Lead to an AV:L Office Exploit
The realistic attack sequence is straightforward:
- An attacker creates or obtains a malicious Office file that targets the affected parsing or rendering path.
- The attacker delivers it through an email attachment, a download link, a shared document repository, collaboration platform, removable media, or another channel.
- A victim’s Windows device receives the file and Office processes it locally.
- If the vulnerability is successfully triggered, attacker-controlled code executes in the Office application’s context.
The attacker may never log into the device. They may never establish a direct network connection to the device. They may not even know the victim’s IP address. Yet the attack can still lead to code execution on the victim’s PC.
The supplied advisory explanation gets part of this right when it says the exploit occurs locally, but it describes the condition poorly. The victim does not generally need to “execute code from the local machine” in the sense of launching an attacker’s executable. The critical event is that a vulnerable Office component processes malicious data locally. Depending on the underlying bug, that could mean opening a document, interacting with it, or potentially invoking a preview or rendering path. Microsoft’s public CVE page does not provide sufficient technical detail to state which exact Office action triggers CVE-2026-65657.
That omission matters. “User interaction” in CVSS is a distinct metric from Attack Vector. AV:L does not automatically tell administrators whether a user must double-click a document, dismiss a warning, enable active content, view a preview, or merely have a component automatically render the file. Those are materially different exposure conditions. Microsoft’s advisory title and the supplied explanation do not resolve them.
What Administrators Should and Should Not Infer
For Windows and Office administrators, the immediate takeaway is to patch the affected Office installations through the update channel Microsoft assigns to the product edition in use. That includes distinguishing Microsoft 365 Apps Click-to-Run deployments from perpetual Office editions that receive MSI-style security updates. Microsoft’s Security Update Guide is the primary record for the CVE, but it does not, from the supplied public material, spell out affected product versions, fixed build numbers, a workaround, or whether the issue has been observed in attacks.
The absence of public exploitation information should not be read as proof that exploitation has not occurred. It only means Microsoft has not identified active exploitation in the material presently available. Equally, the RCE title alone is not evidence of a broad, zero-click campaign.
Security teams should place CVE-2026-65657 in the Office document-threat workflow rather than the external-perimeter workflow:
- Patch managed Office installations and verify that the appropriate Microsoft 365 Apps or Office security update has deployed.
- Use attachment and download controls to reduce the chance that hostile Office documents reach users before patch coverage is complete.
- Review whether users routinely operate Office with local administrator privileges, because successful code execution inherits the user’s effective rights.
- Avoid writing detections or incident notes that characterize the vulnerability as a network-reachable Office service issue unless later technical reporting demonstrates such a path.
The Title Is Conventional, but Microsoft’s Explanation Invites Misreading
Microsoft’s title is conventional security-industry language, not a claim that an attacker can directly exploit Office over the network. The underlying confusion is aggravated by the advisory’s attempt to explain the terminology as though “remote” denotes the attacker’s physical or logical location. It does not.
The cleaner explanation would be: CVE-2026-65657 is called a Remote Code Execution vulnerability because successful exploitation can make Microsoft Office execute attacker-controlled code on the victim’s machine. Its CVSS AV:L rating means the vulnerable Office component is reached through local file or content processing rather than through a network-facing Office service. A malicious file can still be delivered remotely.
Until Microsoft publishes a fuller technical description, the right posture is neither dismissal nor perimeter panic. Treat it as an Office client-side code-execution flaw, patch it through normal Office servicing, and keep document-delivery controls in place for the interval before every endpoint is updated.