EUVD-2026-29677
GHSA-q3w4-cjqg-q4x3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege escalation in Microsoft Office Click-To-Run (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) allows an authenticated local attacker to elevate privileges due to improper access control in the update/servicing component. A successful attack results in total compromise of confidentiality, integrity, and availability with a scope change beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 12th percentile), but the vendor rates technical impact as total.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft) · only source for this CVE.
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Office Click-To-Run (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) contains a local privilege escalation vulnerability (CVE-2026-40420, CVSS 8.8) enabling authenticated local users to achieve complete system compromise. With no public exploit identified at time of analysis, the technical impact still warrants immediate vendor patch deployment to prevent potential system-wide compromise affecting all Office users.
Within 24 hours, classify this as HIGH priority and conduct inventory of all Microsoft Office installations (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) to identify exposed systems. Within 7 days, deploy the patch available per vendor advisory across all affected systems using standard change management and prioritize production and server environments. Within 30 days, complete organization-wide patch deployment and validate through automated compliance scanning that no vulnerable Office installations remain.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB