AV:L — Local. Those labels can coexist, but Microsoft’s own FAQ explains the relationship poorly enough that administrators could reasonably mistake this for a remotely reachable Office flaw.The practical reading is straightforward: this is a vulnerability that may permit arbitrary code to run through the Office graphics component, but Microsoft’s CVSS assessment says exploitation requires local access to the affected machine. It is not rated as a network-reachable vulnerability that an unauthenticated attacker can trigger merely by connecting to an Office service across the internet or internal network.
Microsoft published the CVE on August 11, 2026 as part of its monthly security release. The advisory’s FAQ says the “Remote” in Remote Code Execution refers to the attacker’s location, then says exploitation is carried out locally and requires an attacker or victim to execute code from the local machine. That is an imprecise explanation of two separate security classifications rather than a useful description of an attack path.
CVSS Attack Vector Measures Access, Not the Outcome
CVSS uses Attack Vector to describe the access conditions needed to reach and exploit the vulnerable component. AV:L means the attacker must already have local access: for example, a local user account, an interactive desktop session, a process running on the system, or a situation in which a victim is induced to execute something locally.
It does not mean the vulnerability is harmless, and it does not automatically mean the attacker must be physically sitting at the keyboard. A threat actor who already has a foothold through stolen credentials, malware, remote desktop access, a compromised management tool, or another vulnerability can still be “local” under CVSS once they are operating in the target system’s local execution environment.
The distinction matters for prioritization. A network attack vector (AV:N) generally describes an attacker reaching the vulnerable component over a network, potentially from anywhere the service is exposed. A local attack vector sharply reduces the number of systems and actors that can attempt exploitation directly, which is why it typically receives a lower exploitability score than an otherwise similar network flaw.
FIRST, the organization that maintains CVSS, is explicit on this point: Attack Vector reflects the context in which exploitation is possible, with higher values assigned when an attacker can be more logically or physically remote from the vulnerable component. “Local” is the category for attacks that require local system access, including attacks on desktop applications.
For CVE-2026-65664, that AV:L value is the operational signal administrators should use. This is not a case for treating every Office installation as exposed to an unauthenticated internet-borne exploit. It is a case for patching Office as part of routine security maintenance and for recognizing that compromised endpoints may have another route to code execution.
“Remote Code Execution” Is an Impact Class
The title’s “Remote Code Execution” language describes the potential result: successful exploitation can cause the vulnerable application or component to execute attacker-controlled code. It is not a one-to-one statement about whether the initial exploit arrives over a network.
Security reporting often uses RCE as a broad impact category because code execution is the important security boundary being crossed. The code may execute under the current Office user’s permissions, under a service account, inside a sandbox, or — in more serious cases — with elevated rights. The title alone does not establish which of those contexts applies.
That is why arbitrary code execution is a more precise general term in this instance. If a flaw is triggered locally and causes Office’s graphics component to execute code, it can still be described as code execution. Calling it “remote” follows Microsoft’s vulnerability-title taxonomy, but the CVSS vector makes clear that the exploitation path is local.
Microsoft’s statement that “Remote” refers to the location of the attacker is particularly unhelpful. In ordinary incident-response language, remote code execution usually means an attacker causes code to run on a target system from somewhere else. But if the attacker must already execute code locally to trigger CVE-2026-65664, then the distinction between the attacker’s location and the exploitation context becomes important — and Microsoft has not supplied enough technical detail in the FAQ to resolve it cleanly.
The safer interpretation is that the title categorizes the consequence, while AV:L categorizes the prerequisite. The consequence is code execution; the prerequisite is local access.
A Malicious Document Is Not Automatically an AV:L Attack
The confusion becomes more consequential because Office vulnerabilities are often associated with phishing documents. A malicious Word, Excel, PowerPoint, or other Office file delivered by email may lead readers to assume that any Office code-execution flaw is a classic remote attack.
Under CVSS, that is not necessarily true. If an attacker can send a crafted file remotely and a victim opening it is sufficient to trigger the flaw, the appropriate vector will often be Network with User Interaction Required: AV:N/UI:R. The network metric reflects delivery or access from a remote location; the user-interaction metric captures the victim opening the document or taking another action.
A local rating implies a narrower condition. It may mean the crafted input must already be available locally through a pre-existing foothold, that the attacker needs to launch or manipulate Office on the device, or that an additional local condition is required before the graphics component can be reached. Microsoft’s August 11 advisory does not spell out which of those scenarios applies.
That omission is material. Without a vulnerability description, affected-build table, or a concrete exploitation narrative beyond “execute code from the local machine,” defenders cannot tell whether CVE-2026-65664 is relevant chiefly after endpoint compromise, during lateral movement, or in a local user-to-user attack. The CVSS rating establishes the broad boundary, but it does not provide the operational detail that endpoint teams need for threat hunting.
No independent reporting located for CVE-2026-65664 as of August 12 has added an exploit chain, proof of concept, or real-world exploitation claim. Microsoft’s advisory should therefore be read as the primary record, not as evidence that the flaw is being used in attacks.
Patch It, but Triage It as a Local-Access Issue
For Windows and Microsoft 365 administrators, the correct response is to apply the Office security update Microsoft maps to the affected installation, validate that the update deployed successfully, and include the CVE in normal Office patch compliance reporting. The Office graphics component is used in a widely deployed productivity stack, so leaving a code-execution defect unresolved creates unnecessary risk on endpoints that may later be compromised by another means.
But this CVE should not be placed in the same emergency category as an unauthenticated, network-reachable Office, Exchange, SharePoint, or Windows service vulnerability solely because the title includes “Remote Code Execution.” Its AV:L rating says an attacker cannot begin the exploit from a position entirely outside the machine’s local execution boundary.
That also makes endpoint controls relevant. Least-privilege accounts, application control, endpoint detection and response, restrictions on untrusted executables, and controls that limit access to interactive sessions can reduce the practical utility of a local Office code-execution flaw. Those controls do not replace patching; they reduce the chance that a separate compromise turns CVE-2026-65664 into a useful next-stage technique.
The key correction is linguistic but operationally important: “RCE” describes what exploitation may achieve, while AV:L describes what an attacker needs before exploitation can begin. For CVE-2026-65664, Microsoft’s own CVSS vector is the clearer indicator of immediate exposure.
