The attacker does not need to be at the machine. They send a crafted request or file over the network, and the target runs the code of their choice. It is usually treated as the most serious class of flaw, because it can lead to full control of the system.
How bad it is depends on three things: whether login is needed first, what privileges the vulnerable service runs with and whether the system is reachable from the internet. An unauthenticated RCE on an internet-facing server is the worst case.
Log4Shell (CVE-2021-44228) is the standard example. A single crafted string written to a log could make a vulnerable server fetch and run attacker code. EternalBlue, the Windows SMB flaw behind WannaCry, was another.
Reduce what is reachable from the internet, run services with the least privilege they need, patch RCE flaws first and watch for unexpected child processes on servers.