The short answer is that
“remote code execution” in Microsoft’s naming does not always mean the attacker must literally trigger the bug over the network. It means the vulnerability can let an attacker execute code
on a remote victim system rather than only affecting the attacker’s own machine. In the Microsoft security ecosystem, the
CVE title is often a broad product/category label, while the
CVSS vector describes the most likely attack path or exploitation conditions in more precise scoring terms. Microsoft has previously explained that CVE descriptions and titles are meant to be succinct, while CVSS captures the detailed attributes such as attack vector, privileges, and complexity.
In other words,
AV:L does not contradict the phrase
Remote Code Execution. It usually means the exploitation requires a
local interaction on the target machine, such as opening a document, launching a local helper process, or chaining the flaw with another locally triggered component. Microsoft has used this kind of framing before for Office and Office-adjacent vulnerabilities, where a document or application on the victim’s system triggers code execution in a way that still results in
remote compromise of the victim.
Your interpretation is basically right in spirit: the “remote” part refers to the attacker’s ability to run code on a victim system that is not physically local to them, not necessarily the transport mechanism used to reach the bug. That is why some Office bugs are better thought of as
arbitrary code execution or
client-side code execution vulnerabilities, even though vendors and advisories still group them under the broader RCE label. Microsoft’s earlier guidance on Office and MSDT-style issues shows this distinction clearly: the exploit may begin with local document interaction, yet the end result is still code execution in the context of the victim process or user.
A useful way to read this is:
- RCE = the vulnerability can lead to code execution on the victim system.
- Remote = the attacker can cause that from another system or through remote delivery of content.
- AV:L = the actual trigger requires local conditions on the victim endpoint, even if the attacker initiated the chain remotely.
So, for
CVE-2026-32190, the title is describing the
impact category, while the CVSS metric is describing the
attack mechanics. Those are related, but they are not the same thing.
Source: MSRC
Security Update Guide - Microsoft Security Response Center