Remote arbitrary code execution (RCE) is a vulnerability that allows an attacker to make a target system run code of the attacker’s choosing from a distant location, usually over a network or through a crafted interaction such as a link, file, or request. “Arbitrary” means the attacker is not limited to a harmless action: they can often execute commands, launch malware, or install persistence.
RCE matters because it can turn a single bug into full compromise. In real attacks, it often appears in exposed services, desktop software, document parsers, browser components, or custom link handlers that trust unvalidated input. Defenders look for patchable code paths, limit privileges, isolate risky features, and monitor process trees, command lines, and network activity for signs that a normal click or request became code execution.