Execution capability is the ability of a device to run software locally, rather than only relay input or data. A peripheral with execution capability may have its own CPU, firmware, memory, and update path, which means it can behave more like a small computer than a passive accessory.
This matters in security because execution capability expands the attack surface. If a device can run code, attackers may target its firmware, abuse its update mechanism, or use it as a foothold inside a trusted environment. Defenders should ask whether the device verifies signed updates, isolates its runtime, and limits what code can do. In practice, this changes inventory and trust decisions: a keyboard, controller, printer, or dongle may need review like any other programmable system.