cve 2026 20953

CVE-2026-20953 is a Microsoft Office vulnerability that has generated discussion on WindowsForum due to a perceived mismatch between its CVE title and CVSS base vector. The advisory labels it a Remote Code Execution (RCE) vulnerability, while the CVSS Attack Vector is reported as Local (AV:L). Forum analysis clarifies that the CVE title describes what an attacker can achieve and the origin of the attack, whereas the CVSS vector documents where the vulnerable code must be invoked for exploitation. This distinction—remote delivery combined with local execution—resolves the apparent contradiction. The tag covers community efforts to understand and communicate this nuance for risk assessment and patching prioritization.