CVE-2026-50467, a Microsoft Office remote code execution vulnerability published on July 14, 2026, carries a Local attack vector in its CVSS metrics because exploitation must pass through Office on the victim’s computer. The “remote” in Microsoft’s title describes where the attacker can be located and the resulting ability to run code—not a direct, network-level attack against Office.
Microsoft addresses the apparent contradiction in its Security Update Guide. The company says this class of exploit is also described as arbitrary code execution and requires the attacker or victim to execute or process something on the local machine. An attacker may therefore operate remotely while relying on a malicious document, file, or other locally handled content to reach the vulnerable Office component.
That distinction matters for defenders. AV:L does not mean an attacker needs physical access, an existing interactive login, or a place at the victim’s keyboard.
The Common Vulnerability Scoring System uses Attack Vector to describe the context in which exploitation reaches the vulnerable component. It does not use that metric as a general label for where the adversary sits, how malicious content was delivered, or what happens after exploitation succeeds.
Under the CVSS specification maintained by FIRST, AV:N applies when the vulnerable component can be attacked through its network-facing interface from one or more network hops away. A vulnerable web server processing a crafted request is a straightforward example: the hostile network input directly reaches the code containing the flaw.
AV:L covers a different path. The vulnerable component is not attacked directly through its network stack; exploitation instead depends on local read, write, or execution behavior. CVSS explicitly allows this rating when an attacker tricks another person into opening a malicious document, even if the attacker created and delivered that document from another country.
Office document vulnerabilities are a common source of this terminology. An email service may receive the attachment over the internet, a browser may download it from a website, or a collaboration platform may synchronize it to the endpoint. The vulnerable Office application subsequently parses the file locally, which is the step that triggers the flaw.
The network transported the attack material, but it did not directly invoke the vulnerable Office code. From the perspective of CVSS, the decisive boundary is between delivery and exploitation.
That code generally executes with the permissions available to the affected Office process or signed-in user unless the exploit is paired with a privilege-escalation technique. The practical consequences can include installing malware, accessing documents available to the user, modifying files, harvesting credentials, or establishing persistence.
The phrase arbitrary code execution can be more intuitive in cases such as CVE-2026-50467. It emphasizes the outcome—execution of attacker-chosen instructions—without implying that a listening network port is the vulnerable entry point. Microsoft nevertheless commonly uses “Remote Code Execution Vulnerability” for flaws that can let a remote adversary compromise a victim through malicious content.
Several properties can therefore all be true at once:
FIRST’s CVSS guidance specifically includes social-engineering scenarios in AV:L. It also gives the example of a browser downloading a malicious Office document, saving it locally, and launching an affected Office application to parse it. Although the browser received the file over the network, the Office vulnerability remains local because the vulnerable parser receives the input from the local filesystem or another local component.
This is why administrators should examine the complete vector and Microsoft’s exploitation notes rather than filtering Office findings solely by AV:N. Other metrics describe whether user interaction is required, whether the attacker needs privileges before exploitation, and how severely confidentiality, integrity, and availability can be affected.
A malicious-document flaw rated AV:L may still be highly relevant to an organization whose users routinely exchange Word, Excel, PowerPoint, or other Office files with external parties. Email filtering, Microsoft Defender for Office 365, Protected View, application control, and endpoint detection can add barriers, but none changes the underlying need to apply Microsoft’s security update.
The delivery mechanism can also alter operational exposure without changing the base CVSS vector. A file sent as an unsolicited attachment, hosted on a compromised website, shared through Microsoft Teams, or placed in a OneDrive folder may ultimately reach the same vulnerable parser. CVSS Base metrics describe intrinsic exploit characteristics, not every organization’s mail controls, trust relationships, or user behavior.
Security teams should also account for devices that commonly fall behind Office patch baselines. Remote laptops, nonpersistent virtual desktops, test systems, and machines on deferred Microsoft 365 Apps update channels can retain exposure after centrally managed devices have moved forward.
Until deployment is complete, organizations can reduce opportunity by applying established controls around untrusted Office content. Users should not bypass Protected View or security warnings for unsolicited files, and defenders should investigate Office applications spawning command shells, script hosts, or unfamiliar child processes. Those behaviors are not proof of CVE-2026-50467 exploitation, but they are consistent with the sort of post-exploitation activity that makes Office code-execution flaws valuable.
The key reading is therefore simple: “Remote Code Execution” identifies what a distant attacker may ultimately achieve, while AV:L identifies where the vulnerable Office component processes the exploit. CVE-2026-50467 still belongs in endpoint patching and malicious-document threat models, despite the single letter “L” in its CVSS vector.
Microsoft addresses the apparent contradiction in its Security Update Guide. The company says this class of exploit is also described as arbitrary code execution and requires the attacker or victim to execute or process something on the local machine. An attacker may therefore operate remotely while relying on a malicious document, file, or other locally handled content to reach the vulnerable Office component.
That distinction matters for defenders. AV:L does not mean an attacker needs physical access, an existing interactive login, or a place at the victim’s keyboard.
CVSS Measures the Route Into the Vulnerable Component
The Common Vulnerability Scoring System uses Attack Vector to describe the context in which exploitation reaches the vulnerable component. It does not use that metric as a general label for where the adversary sits, how malicious content was delivered, or what happens after exploitation succeeds.Under the CVSS specification maintained by FIRST, AV:N applies when the vulnerable component can be attacked through its network-facing interface from one or more network hops away. A vulnerable web server processing a crafted request is a straightforward example: the hostile network input directly reaches the code containing the flaw.
AV:L covers a different path. The vulnerable component is not attacked directly through its network stack; exploitation instead depends on local read, write, or execution behavior. CVSS explicitly allows this rating when an attacker tricks another person into opening a malicious document, even if the attacker created and delivered that document from another country.
Office document vulnerabilities are a common source of this terminology. An email service may receive the attachment over the internet, a browser may download it from a website, or a collaboration platform may synchronize it to the endpoint. The vulnerable Office application subsequently parses the file locally, which is the step that triggers the flaw.
The network transported the attack material, but it did not directly invoke the vulnerable Office code. From the perspective of CVSS, the decisive boundary is between delivery and exploitation.
“Remote Code Execution” Describes the Security Impact
Remote code execution is an impact classification rather than a promise that the affected application exposes a remotely reachable service. It tells administrators that a successful attack can cause attacker-controlled code to run on another person’s system.That code generally executes with the permissions available to the affected Office process or signed-in user unless the exploit is paired with a privilege-escalation technique. The practical consequences can include installing malware, accessing documents available to the user, modifying files, harvesting credentials, or establishing persistence.
The phrase arbitrary code execution can be more intuitive in cases such as CVE-2026-50467. It emphasizes the outcome—execution of attacker-chosen instructions—without implying that a listening network port is the vulnerable entry point. Microsoft nevertheless commonly uses “Remote Code Execution Vulnerability” for flaws that can let a remote adversary compromise a victim through malicious content.
Several properties can therefore all be true at once:
- The adversary can prepare and send the exploit from a remote location.
- The victim’s endpoint must receive and locally process the malicious content.
- Office, rather than the mail server or file-transfer service, contains the vulnerable code.
- Successful exploitation can run attacker-controlled code on the victim’s machine.
Local Is Not the Same as Low Risk
The word “local” can give vulnerability dashboards and patch reports a misleading sense of reassurance. In everyday IT usage, a local vulnerability often suggests that an attacker already needs an account or a foothold on the target. CVSS uses a broader and more technical definition.FIRST’s CVSS guidance specifically includes social-engineering scenarios in AV:L. It also gives the example of a browser downloading a malicious Office document, saving it locally, and launching an affected Office application to parse it. Although the browser received the file over the network, the Office vulnerability remains local because the vulnerable parser receives the input from the local filesystem or another local component.
This is why administrators should examine the complete vector and Microsoft’s exploitation notes rather than filtering Office findings solely by AV:N. Other metrics describe whether user interaction is required, whether the attacker needs privileges before exploitation, and how severely confidentiality, integrity, and availability can be affected.
A malicious-document flaw rated AV:L may still be highly relevant to an organization whose users routinely exchange Word, Excel, PowerPoint, or other Office files with external parties. Email filtering, Microsoft Defender for Office 365, Protected View, application control, and endpoint detection can add barriers, but none changes the underlying need to apply Microsoft’s security update.
The delivery mechanism can also alter operational exposure without changing the base CVSS vector. A file sent as an unsolicited attachment, hosted on a compromised website, shared through Microsoft Teams, or placed in a OneDrive folder may ultimately reach the same vulnerable parser. CVSS Base metrics describe intrinsic exploit characteristics, not every organization’s mail controls, trust relationships, or user behavior.
Patch Prioritization Should Follow the Attack Chain
For CVE-2026-50467, administrators should treat the AV:L designation as evidence that endpoint-side processing is required—not as evidence that remote attackers cannot use the flaw. Office deployments covered by Microsoft’s July 14, 2026 security release should be inventoried and updated through the organization’s normal Microsoft 365 Apps, Click-to-Run, Windows Update, Microsoft Configuration Manager, or Intune servicing process, as applicable.Security teams should also account for devices that commonly fall behind Office patch baselines. Remote laptops, nonpersistent virtual desktops, test systems, and machines on deferred Microsoft 365 Apps update channels can retain exposure after centrally managed devices have moved forward.
Until deployment is complete, organizations can reduce opportunity by applying established controls around untrusted Office content. Users should not bypass Protected View or security warnings for unsolicited files, and defenders should investigate Office applications spawning command shells, script hosts, or unfamiliar child processes. Those behaviors are not proof of CVE-2026-50467 exploitation, but they are consistent with the sort of post-exploitation activity that makes Office code-execution flaws valuable.
The key reading is therefore simple: “Remote Code Execution” identifies what a distant attacker may ultimately achieve, while AV:L identifies where the vulnerable Office component processes the exploit. CVE-2026-50467 still belongs in endpoint patching and malicious-document threat models, despite the single letter “L” in its CVSS vector.
References
- Primary source: MSRC
Published: 2026-07-14T07:00:00-07:00
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
