Microsoft Office CVE-2026-85340

Requires the attacker to already have authenticated, low-privileged local code execution on a host where Microsoft Office Click-To-Run (Microsoft 365 Apps / Office LTSC 2021/2024) is installed - the SSVC 'authorized attacker' designation and CVSS PR:L/AV:L confirm a local foothold is a hard prerequisite. No user interaction is needed (UI:N) and it works against default Office installations, but there is NO remote attack surface: exploitation is impossible without prior access to the machine. Patched builds (Office LTSC 2021 >=16.0.14334.20974, Office LTSC 2024 >=16.0.17932.21056, and updated Microsoft 365 Apps channels) close the window, so the primary limiting factors are the local-access requirement and patch status.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, base 7.8 HIGH) in Microsoft Office Click-To-Run, driven by a CWE-416 use-after-free. The CVSS vector consistently indicates a logged-in, low-privileged local attacker (AV:L, PR:L) with no user interaction and low attack complexity, yielding total compromise (C:H/I:H/A:H). All exploitation-pressure signals point to LOW urgency relative to the high severity score: no CISA KEV listing, no public POC identified, and CISA SSVC explicitly rates Exploitation as 'none' and Automatable as 'no', consistent with a local-only EoP that cannot be sprayed remotely. SSVC Technical Impact is 'total', which aligns with the C/I/A:H impact metrics. EPSS is not provided in the input, so exploitation probability cannot be independently quantified. Net: this is a real, patch-worthy local privilege-escalation bug most valuable as a post-compromise step, not an internet-facing emergency. It is not a high-CVSS-but-no-real-risk phantom, since the impact is genuine, but neither is it a drop-everything item absent any evidence of active exploitation. Note a minor signal conflict: the input Tags include 'Denial Of Service', whereas the description and CVSS (C:H/I:H) describe privilege escalation/code execution, not a DoS - treat the DoS label with caution.

A low-privileged user, or malware already running under a standard user account, on a workstation with Microsoft 365 Apps / Office Click-To-Run installed triggers the use-after-free in the Click-To-Run service to corrupt memory and run attacker-controlled code at a higher privilege level. No public exploit code has been identified at the time of analysis, and because the vector is local (AV:L), the attacker must already have code execution on the host, making this a privilege-escalation link in a larger intrusion rather than an initial-access vector.