EUVD-2026-29635
GHSA-qrjq-78wx-3j3x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local authenticated low-priv user (AV:L/PR:L) abuses a SYSTEM servicing component with coarse access control, causing a scope change (S:C) and total C/I/A on the host.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Office Click-To-Run (the servicing/update engine behind Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated low-privileged user escalate to higher privileges on the host due to insufficiently granular access control (CWE-1220). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change with total confidentiality, integrity, and availability impact, meaning a successful attacker crosses a security boundary from the Office servicing context to the wider system. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none', so this is a serious-but-not-actively-exploited local EoP that should be patched on the normal accelerated cycle.
Technical ContextAI
Microsoft Office Click-To-Run (C2R) is Microsoft's streaming install and auto-update technology used by Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024; it runs a persistent OfficeClickToRun service (ClickToRunSvc) under SYSTEM to manage installation, servicing, and updates. CWE-1220 (Insufficient Granularity of Access Control) indicates the underlying flaw is that a privileged operation or resource exposed by this high-privilege servicing component enforces access at too coarse a level, allowing a low-privileged local user to reach functionality or objects that should be restricted. The CPE data confirms the affected surface is the Office application/servicing layer (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024) rather than a specific document parser. The scope change (S:C) in the CVSS vector is consistent with a component running at SYSTEM whose weak access control lets a standard user influence operations executed with elevated privileges.
RemediationAI
Vendor-released patch: available from Microsoft - apply the Office security update referenced in MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436 and match the exact fixed build for your channel via https://aka.ms/OfficeSecurityReleases. Because these are Click-To-Run products, remediation is normally automatic: ensure Office auto-updates are enabled and force an update (File > Account > Update Options > Update Now, or push the current channel build via your management tooling such as Intune/ConfigMgr/Office Deployment Tool). If patching must be deferred, reduce exposure by limiting the number of low-privileged interactive users on affected hosts and restricting who can run untrusted code on shared or multi-user workstations, since exploitation requires local authenticated access - note this only shrinks the attacker pool and is not a substitute for the update. No specific Microsoft-documented configuration workaround is provided in the available data, so patching is the authoritative fix; additional references: https://vuldb.com/vuln/363167 and https://nvd.nist.gov/vuln/detail/CVE-2026-35436.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today