CVE-2026-88109: Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Other sources
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running the listed Microsoft 365 Apps for Enterprise or Microsoft Office LTSC 2021 or 2024 editions are in scope. Exploitation is local rather than network-based.
What access does an attacker need to exploit it?
An attacker must already be authorized on the affected system and have local access. No user interaction is required according to the supplied severity vector.
What is the likely impact if exploitation succeeds?
Successful exploitation can allow elevation of privileges locally. The severity vector indicates high impact to confidentiality, integrity, and availability.