cve 2026 20950

CVE-2026-20950 is a Microsoft Excel vulnerability that Microsoft labels as Remote Code Execution, yet its CVSS vector lists Attack Vector as Local (AV:L). This apparent contradiction is deliberate: the CVE title describes the attacker's ability to deliver a malicious file remotely, while the CVSS AV:L metric documents that the vulnerable code executes within the local Excel process. Discussions on WindowsForum clarify that both statements are accurate and answer different questions. For Windows administrators and security professionals, understanding this distinction is critical for correctly assessing risk and prioritizing mitigations. The tag covers analysis of Microsoft's advisory language, CVSS scoring rationale, and practical guidance for handling Office document parsing flaws.