Except, once again Microsoft crapped the bed... it's not an RCE in any capacity...

> Revision 2.1, Nov 7: “Added an FAQ and updated the CVSS score. This is an informational change only.” > Vector: now AV:L and UI:R (local attack vector, user interaction required), scoring 7.0.