EUVD-2026-29675
GHSA-89vp-6c77-3jr6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP needing an existing low-privileged account (AV:L, PR:L), no user interaction, and use-after-free yielding full code execution at higher privilege (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege elevation in Microsoft Office Click-To-Run (affecting Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated local attacker exploit a use-after-free memory corruption to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS probability is negligible (0.04%) and CISA SSVC records exploitation status as none, indicating this is a patch-on-schedule issue rather than an emergency.
Technical ContextAI
The flaw resides in Microsoft Office Click-To-Run (C2R), the streaming install-and-update servicing technology Microsoft uses to deliver and maintain Office/Microsoft 365 Apps. The root cause is CWE-416 (Use After Free): a component frees a memory object but retains and later dereferences a dangling pointer, allowing an attacker to reoccupy that freed memory with controlled data and corrupt program state. Because C2R components and its updater run with elevated context on the endpoint, successful reuse of the freed object can be steered into arbitrary code execution at a higher privilege level. The affected code is common to the C2R servicing stack shared across Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024, per the NVD CPE data.
RemediationAI
Apply the Microsoft-provided fix: because these products use Click-To-Run, ensure Office is allowed to update automatically to the current serviced build, or trigger an update via File > Account > Update Options > Update Now, and confirm the patched build against Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418 and the Office security release notes at https://aka.ms/OfficeSecurityReleases (Patch available per vendor advisory; an exact fixed build number was not provided in the input, so verify the target build in the MSRC update guide before deploying). No standalone workaround is published for this local elevation-of-privilege; as compensating controls until patching completes, limit interactive and local logon rights on shared or multi-user hosts so untrusted low-privileged accounts cannot run code locally (trade-off: may disrupt legitimate shared-workstation and terminal-server use), and enforce least-privilege plus application allow-listing to reduce an attacker's ability to stage the exploit (trade-off: allow-listing tuning overhead). These controls reduce but do not eliminate the risk, so patching remains the primary fix.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today