cvss local vector

The tag cvss local vector covers discussions about the CVSS attack vector component that indicates a vulnerability must be exploited locally. In WindowsForum threads, users analyze cases like CVE-2026-26107, where a Microsoft Excel RCE vulnerability is labeled "Remote" in the advisory but has a CVSS vector of AV:L (Local). The tag explains the distinction: the CVE title describes where an attacker can start (remote), while the CVSS local vector describes where the vulnerable code executes (locally in Excel). This helps defenders understand apparent mismatches in vulnerability reporting and correctly interpret CVSS scoring for local attack vectors in Microsoft products.