vulnerability scoring

Yes — the apparent mismatch comes from Microsoft using two different layers of description. The CVSS field AV:L is describing the attack vector in scoring terms: the exploit has to be triggered through a local file-processing path on the victim machine, usually by opening or otherwise handling a...

Microsoft’s advisory that lists CVE-2026-20948 as a “Microsoft Word Remote Code Execution Vulnerability” is not mistaken when a published CVSS vector shows Attack Vector = Local (AV:L); the two labels answer different operational questions and together give a fuller picture of exploit impact and...

Microsoft’s advisory for CVE-2026-20955 labels the bug as a “Microsoft Excel Remote Code Execution Vulnerability,” yet the published CVSS Attack Vector for the issue is Local (AV:L) — a wording mismatch that has left many admins and vulnerability managers asking whether Microsoft misclassified...