What is the CVSS score of CVE-2026-47293?

CVE-2026-47293 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-47293?

Microsoft Office Click-To-Run contains a local privilege escalation vulnerability (CVE-2026-47293, CVSS 7.0) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-47293?

Within 24 hours: Conduct complete software inventory to identify all Click-To-Run deployments; implement Group Policy restrictions limiting Click-To-Run functionality (disable or restrict to essential business processes); enable Windows Event Log monitoring for privilege escalation events (Event IDs 4672, 4688). Within 7 days: Deploy endpoint detection and response (EDR) tools configured to detect anomalous Office application process execution and privilege escalation attempts; restrict Click-To-Run execution to specific user groups with documented business justification. Within 30 days: Develop phased migration plan to Office 365 ProPlus or alternative productivity solutions not dependent on Click-To-Run; establish daily MSRC advisory subscriptions and define patch deployment procedures for when vendor releases mitigation.

Microsoft Office CVE-2026-47293

EUVD-2026-35575 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-g73m-vgr6-fw8x

Microsoft Use After Free Memory Corruption Denial Of Service 365 Apps Office Office 2021 Office 2024

7.0

CVSS 3.1 · Vendor: microsoft

Temporal: 6.1

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:56 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Office Click-To-Run stems from a use-after-free condition (CWE-416) that lets an authorized low-privilege user elevate to higher privileges on the host. The flaw, reported by Microsoft's MSRC, carries a CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation requires local access, low privileges, and a successful race-window or memory-state condition. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Microsoft Office Click-To-Run (C2R) is the streaming installer and update servicing technology used to deploy and maintain Microsoft 365 / Office desktop applications; it runs privileged components (notably the OfficeClickToRun.exe service) under SYSTEM to manage package state, virtualization, and updates. The vulnerability falls under CWE-416 (Use After Free), a memory-safety defect where an object reference is dereferenced after the underlying allocation has been freed, allowing the attacker to influence the contents of the reclaimed memory and corrupt control flow or data. Because the privileged C2R service handles IPC from lower-integrity callers, a UAF in its handling path is a classic local elevation primitive.

RemediationAI

Apply the Microsoft Office Click-To-Run update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47293 - patch available per vendor advisory, but the exact fixed build was not supplied in this dataset, so administrators should pull the per-channel build numbers (Current, Monthly Enterprise, Semi-Annual Enterprise) from the MSRC page and confirm via 'File > Account > About' on endpoints. Because Click-To-Run normally auto-updates, the practical compensating step where patching lags is to verify the C2R update service (ClickToRunSvc) is running and not blocked by network egress rules to officecdn.microsoft.com, and to push updates via the Office Deployment Tool or Intune update rings. As a compensating control on un-patched hosts, restrict interactive logon and untrusted code execution on systems running Office, since the bug requires a local low-privileged foothold to weaponize; disabling Office is generally not viable given the productivity impact.