Remote code execution

Remote code execution, usually shortened to RCE, means an attacker can make your computer run code of their choosing without ever touching it. It is the top of the severity scale because everything else follows from it. Once someone can run code as your application, they inherit that application’s permissions. If it is a video call client, that includes your camera, your microphone and your screen.

RCE flaws usually come from a program trusting data it received from outside. A classic pattern is a memory-corruption bug: the software is told “the next piece of data is this many bytes long”, believes it, and writes past the end of the space it reserved, overwriting instructions that decide what runs next. When an RCE bug also requires no action from the victim, it is a zero-click attack, which is about as bad as it gets.