Microsoft Office CVE-2026-70276

Exploitation requires the attacker to already have local, authenticated access to a system running an affected Microsoft Office Click-To-Run installation (Microsoft 365 Apps for Enterprise, Office LTSC 2021 below 16.0.14334.20974, or Office LTSC 2024 below 16.0.17932.21056) and to execute code as a low-privileged user (PR:L). No user interaction is needed (UI:N) and the default Click-To-Run configuration is sufficient - there is no special feature or setting prerequisite. The principal limiting factors are the local-only attack vector (AV:L, no remote/network reachability) and high attack complexity (AC:H), the latter reflecting the race or heap-state condition inherent to reliably exploiting a use-after-free, which reduces reliability and may require repeated attempts.

This is a legitimately moderate-to-high priority patching item but not an emergency. The CVSS 3.1 base score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, high-complexity, low-privilege privilege-escalation primitive with total CIA impact - a classic use-after-free (CWE-416) exploitation profile where the high attack complexity reflects the race/heap-grooming conditions typical of UAF bugs. The signals are consistent and point toward LOW immediate exploitation likelihood: the CISA SSVC decision framework explicitly rates Exploitation as 'none' and Automatable as 'no' (as expected for a local EoP requiring an existing foothold), while rating Technical Impact as 'total' (consistent with C:H/I:H/A:H). There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Note one data tension worth flagging: the input Tags include 'Denial Of Service', but the description and CVSS both characterize this as a privilege-escalation/memory-corruption issue (A:H covers the availability aspect), so the DoS framing appears secondary or mislabeled. Overall: prioritize as a routine-but-important privilege-escalation patch - it meaningfully raises risk when chained after initial access, but the local-only vector, high complexity, and 'Exploitation: none' status mean it is not a drop-everything issue.

A low-privileged user who already has local code execution on a workstation (e.g. via phishing, a malicious document, or a standard non-admin account) runs a crafted program that triggers the use-after-free in the Office Click-To-Run component to corrupt memory and execute code in a higher-privilege context. Because AC:H reflects a race or timing condition, the attacker may need multiple attempts to win the race before achieving reliable elevation. No public exploit code has been identified at time of analysis, so weaponization would require independent development.