Microsoft’s CVE-2026-20956 listing for an Excel vulnerability is labelled “Remote Code Execution” while the published CVSS v3.1 vector records Attack Vector: Local (AV:L) — a combination that causes confusion but is technically coherent once you separate attacker origin and impact from where the exploitable code actually runs.
Microsoft’s advisory headline emphasizes impact: an off‑host adversary can cause arbitrary code to run on a target if the exploitation chain completes. At the same time, the CVSS Attack Vector metric documents the locality of the code at the moment the vulnerability is triggered. When Excel’s native parser must run inside the local Excel process to reach the bug, CVSS correctly assigns AV:L even if the crafted file was delivered remotely (for example, by email or cloud share).
This is a recurring pattern for document‑parsing vulnerabilities: delivery can be remote while the trigger (the moment memory corruption or logic failure occurs) is local. The CVE title communicates operational severity and attacker origin; CVSS provides a standardized, mechanistic description of exploitability that is useful for automated triage and risk systems.
Because these exploits don’t rely on macros, macro‑blocking controls alone are insufficient. That increases the urgency for patching, layered mitigations, and controls that affect file handling and previewing.
Security teams should treat CVE‑class RCE advisories as high priority regardless of AV:L, inventory and patch server‑side parsing endpoints as critical, and apply layered mitigations (patching, Protected View, gateway hardening, EDR, ASR rules, least privilege) to reduce exposure while updates are deployed. Ignoring the distinction or relying solely on headline wording risks both under‑ and over‑reacting; reading the CVE title and the full CVSS vector together yields the correct operational picture for triage and mitigation.
Source: MSRC Security Update Guide - Microsoft Security Response Center
Background / Overview
Microsoft’s advisory headline emphasizes impact: an off‑host adversary can cause arbitrary code to run on a target if the exploitation chain completes. At the same time, the CVSS Attack Vector metric documents the locality of the code at the moment the vulnerability is triggered. When Excel’s native parser must run inside the local Excel process to reach the bug, CVSS correctly assigns AV:L even if the crafted file was delivered remotely (for example, by email or cloud share).This is a recurring pattern for document‑parsing vulnerabilities: delivery can be remote while the trigger (the moment memory corruption or logic failure occurs) is local. The CVE title communicates operational severity and attacker origin; CVSS provides a standardized, mechanistic description of exploitability that is useful for automated triage and risk systems.
Why the CVE says "Remote Code Execution" while CVSS shows AV:L
Two different questions, two different answers
- CVE/advisory title = What can an attacker achieve and from where can they attempt it?
The advertiser’s goal is to communicate the worst-case outcome and to signal urgency: an external actor can cause code execution on a victim's machine (that’s the operational story the title is designed to convey). - CVSS Attack Vector (AV) = Where must the vulnerable code be executing when the exploit triggers?
CVSS focuses on the locality of the triggering operation. If the exploit executes when a local process (Excel) parses a file, CVSS assigns AV:L to avoid double-counting network delivery.
Practical example: the typical Excel exploit chain
- Attacker crafts a malicious Excel workbook that targets a memory‑safety or parsing bug (use‑after‑free, heap overflow, out‑of‑bounds access).
- The attacker remotely delivers the workbook via email attachment, cloud share link, or download.
- Victim opens (or a preview handler renders) the workbook in local Excel.
- Excel’s parser encounters malformed data, triggers memory corruption, and attacker‑controlled code executes inside the Excel process under the logged‑on user’s privileges.
CVSS mechanics explained
What AV:L actually means
CVSS Attack Vector has four values:- AV:N (Network) — exploitable across network boundaries without local user interaction.
- AV:A (Adjacent) — requires adjacency to the victim (same subnet or similar).
- AV:L (Local) — requires local execution or local user action (opening a file, running an app).
- AV
(Physical) — physical access required.
Other CVSS fields commonly seen with document RCEs
- UI:R (User Interaction required) — a user must open or preview the file for the bug to trigger.
- PR:N (Privileges Required: None) — the exploit does not require prior privileges; it runs in the context of the user who opens the file.
- C/I/A (Confidentiality/Integrity/Availability) often rated High for true arbitrary code execution.
The server‑side exception (when AV becomes AV:N)
There is a critical exception: if a network‑facing service (for example, an email gateway that generates attachment previews, Office Online Server, or a document‑conversion service) parses the same vulnerable content on behalf of remote clients, the vulnerable code executes in a network‑bound process. In that case the Attack Vector should be AV:N because an attacker can trigger the vulnerable code remotely without per‑victim user interaction. Vendors explicitly call out this server‑side risk when applicable because it materially raises exposure and urgency.Technical anatomy: why document parsing bugs enable RCE without macros
Excel implements complex native parsers for legacy BIFF formats, Open XML parts, OLE/ActiveX handling, formula engines, chart metadata, and renderers. These native code paths have historically contained memory‑safety defects (use‑after‑free, heap overflow, OOB reads/writes). When attackers can control file data, they can manipulate parser state and memory to hijack control flow — achieving arbitrary code execution without macros or scripts. These are called data‑only or parser‑level exploits.Because these exploits don’t rely on macros, macro‑blocking controls alone are insufficient. That increases the urgency for patching, layered mitigations, and controls that affect file handling and previewing.
Operational implications for defenders
Why AV:L should not be interpreted as “low risk”
- Ubiquity of Excel — installed on millions of endpoints, so the chance a crafted file reaches a user is high.
- Low‑friction delivery channels — e‑mail, cloud collaboration, shared drives allow attackers to distribute malicious files cheaply and at scale.
- Social engineering effectiveness — convincing a user to open a spreadsheet is a common, low‑cost tactic.
- Preview/rendering features — some environments render attachments automatically, lowering the bar for exploitation.
Inventory server‑side parsing points
Defenders must identify services that perform server‑side document parsing or previewing, such as:- Email gateways and webmail attachment previewers
- Document management and collaboration platforms
- Office Online Server and any document‑conversion services
- Cloud storage preview/render flows
Short‑term mitigations and tactical checklist
Apply the patch is the primary fix; in parallel, take immediate mitigations that reduce exposure while patching rolls out.- Apply Microsoft’s security updates for affected Excel/Office builds as an immediate priority. Validate installations via your patch management tooling.
- Harden mail gateways and file scanning: block or quarantine suspicious attachments and enforce strict attachment policies for external mail.
- Disable automatic previewing of attachments in webmail and client UIs; require explicit download before a file is opened.
- Enforce Protected View and Application Guard for Office where available — open files from untrusted sources in sandboxed or read‑only modes.
- Apply Office Attack Surface Reduction (ASR) rules and EDR policies that can block suspicious process behavior and child process creation from Office applications.
- Restrict macros to signed content and avoid “enable all macros” defaults; macro hardening is necessary but not sufficient for parser bugs.
- Conduct hunts in EDR telemetry for anomalous Excel behavior, dropped payloads, and suspicious child processes.
Detection and post‑exploitation considerations
- Tune EDR to look for unusual Office process behavior such as spawned cmd/PowerShell, unexpected DLL load patterns, or network connections initiated by Excel.
- Preserve forensic artifacts (process memory, file samples, timeline logs) if you suspect exploitation.
- Assume compromise if suspicious indicators are found — attackers often follow parser exploitation with persistence and lateral movement.
Messaging and triage: strengths and risks of vendor headlines
Strengths of the “Remote Code Execution” headline
- Immediate triage signal — RCE is an operationally meaningful category that prompts rapid action from defenders who prioritize by impact.
- Clear worst‑case framing — it warns that an external actor can ultimately run code on a target machine, which aligns priorities in patch cycles.
Risks and sources of confusion
- Headline vs mechanics mismatch — teams that ingest only titles into automation pipelines may misinterpret AV:L as “not network‑exploitable” and deprioritize critical patches. Automation that ignores CVSS breakdowns risks misallocation.
- Overlooking server‑side parsing — organizations sometimes fail to inventory server components that parse documents and provide previews, which can materially increase exposure.
- User education gaps — defenders may incorrectly think AV:L means “hard to exploit,” but real world distribution channels and social engineering make exploitation practical at scale.
Critical analysis and recommended policy changes
What vendors do well
- Using the RCE label conveys urgency and aligns with defenders’ triage heuristics.
- Publishing CVSS vectors and advisory details supplies the necessary mechanistic context for technical teams.
- Advisories often include mitigation guidance and patch mapping, which is operationally valuable.
Where communication and tooling fall short
- Many automated vulnerability intake systems rely on CVE titles or only the base score and strip out CVSS vector details, leading to potential misprioritization.
- Security teams may lack clear inventories of server‑side document processors, resulting in blind spots that can be exploited at scale.
- Headline language without structured metadata (e.g., an explicit “requires user interaction” flag surfaced to SIEM/ITSM) makes automation fragile.
Recommended changes for defenders and vendors
- Vendor advisories should always include a clear, machine‑parsable flag for “server‑side parsing exposed” to help prioritize AV:N‑style remediation where applicable.
- Vulnerability intake pipelines should parse and act on full CVSS vectors and advisory metadata, not only the title or base score.
- Organizations should maintain a formal inventory of document‑parsing touchpoints (email gateways, conversion services, preview engines) and treat them as high‑risk assets in patch cycles.
When to treat the advisory as truly “remote” (network exploitable)
Treat the vulnerability as network‑exploitable (AV:N) if any of the following apply:- A network‑accessible service (email gateway, Office Online Server, DMS preview service) invokes the vulnerable parser.
- Automated file processing pipelines perform conversions or renderings without isolating the parser.
- Third‑party services you rely on perform server‑side rendering of uploaded Office files.
Conclusion
The apparent contradiction between CVE‑style titles (Remote Code Execution) and a CVSS Attack Vector of AV:L (Local) is a matter of messaging versus mechanistic scoring: the CVE title signals attacker origin and ultimate impact, while CVSS documents the location of the vulnerable code at the moment it is triggered. For document‑parsing bugs in Excel, the usual pattern is remote delivery + local execution — a model that makes AV:L the correct CVSS value while still justifying the “Remote Code Execution” label in the advisory headline.Security teams should treat CVE‑class RCE advisories as high priority regardless of AV:L, inventory and patch server‑side parsing endpoints as critical, and apply layered mitigations (patching, Protected View, gateway hardening, EDR, ASR rules, least privilege) to reduce exposure while updates are deployed. Ignoring the distinction or relying solely on headline wording risks both under‑ and over‑reacting; reading the CVE title and the full CVSS vector together yields the correct operational picture for triage and mitigation.
Source: MSRC Security Update Guide - Microsoft Security Response Center
