CVE-2026-85340: Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Other sources
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this vulnerability?
The attacker must already be authorized on the affected system and have local access. The issue enables elevation of privileges from that existing access.
Which Office products are identified as affected?
The affected products listed are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 for 32-bit and 64-bit editions, and Microsoft Office LTSC 2024 for 32-bit and 64-bit editions.
Does exploitation require user interaction or remote network access?
The supplied vector indicates local attack access and no user interaction requirement. It does not describe remote exploitation.