document parsing risk

The document parsing risk tag covers vulnerabilities where malicious code is executed locally after a user opens a crafted file, such as an Excel spreadsheet. A key example is CVE-2026-20956, an Excel remote code execution vulnerability that is delivered remotely but requires local execution. This tag explains the confusion between attack vector and impact in Microsoft advisories, highlighting how document parsing flaws can lead to code execution on the target system. Discussions focus on understanding the technical details of such vulnerabilities, including CVSS scoring and the distinction between remote delivery and local exploitation.