cvss attack vector

The short answer is that “Remote Code Execution” in Microsoft’s CVE title describes the impact class, not necessarily the CVSS attack vector. Microsoft’s own guidance and long-standing MSRC usage show that a vulnerability can be labeled RCE even when exploitation requires local user interaction...

Microsoft’s use of “Remote Code Execution” in a CVE title does not always mean the exploit is launched over the network from a distant attacker. In Microsoft’s terminology, the label describes the impact of the bug: if exploited successfully, it can let an attacker run code on the target system...