cve-2026-45469

CVE-2026-45469 is a Microsoft Excel remote code execution vulnerability where the CVSS attack vector is classified as local (AV:L) because exploitation requires code to run on the target machine, typically after a user opens or executes attacker-supplied content. This apparent contradiction stems from Microsoft's use of 'remote' to describe the attacker's position rather than the final exploit step. Understanding this distinction is critical for defenders assessing exposure, user interaction, and patch urgency. Discussions on WindowsForum clarify why AV:L still demands real patch urgency despite the local classification.