EUVD-2026-29675
GHSA-89vp-6c77-3jr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
DeliveryExecute code reaching Click-To-Run component
-
ExploitTrigger use-after-free and groom heap
-
ExecutionReuse freed object to hijack execution
-
ImpactElevate privileges to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires prior local access to the target host and an existing low-privileged authenticated account (CVSS PR:L, AV:L), so this cannot be launched remotely and is not exploitable by a fully unauthenticated attacker; no second-user interaction is needed (UI:N). Concretely, the attacker must be able to execute code locally that reaches the Microsoft Office Click-To-Run component containing the use-after-free. Limiting factors: the vulnerable Office Click-To-Run software must be installed (Microsoft 365 Apps for Enterprise, Office 2019, or Office LTSC 2021/2024), and the attacker must already hold a local foothold - this is an escalation primitive, not an initial-access vector, which materially narrows real-world exploitability to hosts where an attacker already has some access. |
| Impact | The signals are internally consistent and point to a moderate, non-urgent local risk. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, HIGH) requires local access and existing low privileges, with no user interaction, and yields total confidentiality/integrity/availability impact within an unchanged scope - a classic local elevation-of-privilege profile. Corroborating this, CISA's SSVC framework rates Exploitation as none, Automatable as no, and Technical Impact as total, and the EPSS score is very low at 0.04% (13th percentile). This CVE is not in CISA KEV. The one inconsistency worth noting: the vendor Tags list 'Denial Of Service' while the CVSS impact set and description describe a use-after-free enabling privilege elevation with high integrity/confidentiality impact - the DoS tag likely reflects a secondary memory-corruption effect and should not be read as the primary risk. Overall this is a real but low-priority local EoP: patch in the normal cycle, prioritize multi-user or shared hosts where local low-privilege footholds are more consequential. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account or foothold on a workstation (for example, via a phished standard-user session) runs a crafted program or document-triggered code path that drives the vulnerable Click-To-Run component into freeing and then reusing a memory object under attacker control. By grooming the heap to reoccupy the freed allocation, the attacker corrupts execution flow to run code at elevated privilege, escalating from standard user toward SYSTEM. No public exploit is identified at time of analysis and no user interaction by a second party is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege elevation in Microsoft Office Click-To-Run (affecting Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated local attacker exploit a use-after-free memory corruption to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS probability is negligible (0.04%) and CISA SSVC records exploitation status as none, indicating this is a patch-on-schedule issue rather than an emergency.
RemediationAI
Apply the Microsoft-provided fix: because these products use Click-To-Run, ensure Office is allowed to update automatically to the current serviced build, or trigger an update via File > Account > Update Options > Update Now, and confirm the patched build against Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418 and the Office security release notes at https://aka.ms/OfficeSecurityReleases (Patch available per vendor advisory; an exact fixed build number was not provided in the input, so verify the target build in the MSRC update guide before deploying). No standalone workaround is published for this local elevation-of-privilege; as compensating controls until patching completes, limit interactive and local logon rights on shared or multi-user hosts so untrusted low-privileged accounts cannot run code locally (trade-off: may disrupt legitimate shared-workstation and terminal-server use), and enforce least-privilege plus application allow-listing to reduce an attacker's ability to stage the exploit (trade-off: allow-listing tuning overhead). These controls reduce but do not eliminate the risk, so patching remains the primary fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Microsoft Office Click-To-Run (C2R), the streaming install-and-update servicing technology Microsoft uses to deliver and maintain Office/Microsoft 365 Apps. The root cause is CWE-416 (Use After Free): a component frees a memory object but retains and later dereferences a dangling pointer, allowing an attacker to reoccupy that freed memory with controlled data and corrupt program state. Because C2R components and its updater run with elevated context on the endpoint, successful reuse of the freed object can be steered into arbitrary code execution at a higher privilege level. The affected code is common to the C2R servicing stack shared across Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024, per the NVD CPE data.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP needing an existing low-privileged account (AV:L, PR:L), no user interaction, and use-after-free yielding full code execution at higher privilege (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Office Click-To-Run vulnerabilities in Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024 enable local privilege escalation across endpoints, creating insider-threat and post-compromise lateral-movement risks. The memory-corruption flaw requires local system access but allows elevation to higher privileges, compromising affected system integrity and potentially exposing sensitive corporate data. Vendor patches are available with negligible exploitation activity (0.04% EPSS), enabling rapid remediation through standard patch management.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB