Office Click-To-Run CVE-2026-88109

Requires the attacker to already have local, authenticated low-privileged code execution on a Windows system with Microsoft Office installed via Click-To-Run (Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024); exploitation is against such a default C2R deployment and needs no user interaction. The limiting factor is that this cannot be triggered remotely or by an unauthenticated actor (AV:L, PR:L) - it is a post-access privilege-escalation primitive, so an initial foothold is the prerequisite that bounds real-world risk; successful exploitation also depends on reliably winning the use-after-free reuse/heap-grooming to control the freed object.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N) in Microsoft Office Click-To-Run, driven by a CWE-416 use-after-free. The CVSS vector is internally consistent with the description: local attack vector, low complexity, and low privileges (an already-authenticated local user), with no user interaction and full C/I/A impact - i.e., a logged-in user escalating toward higher/SYSTEM privileges. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals here are the CVSS severity and the inherently reliable exploitation primitive that memory-corruption EoP bugs in ubiquitous software tend to attract. Net assessment: a genuine patch-priority item because of Office's enormous footprint and the local EoP nature (useful as a post-compromise/chaining step for malware and lateral movement), but NOT an emergency drop-everything issue absent any exploitation or POC evidence. Note a data conflict to resolve: the input Tags include 'Denial Of Service', which contradicts the description (privilege elevation) and the C:H/I:H/A:H impact vector - the primary impact is EoP, not DoS; treat the DoS tag with skepticism.

An attacker who already has a low-privileged foothold on a Windows host (via phishing, a compromised standard-user account, or earlier malware) runs a crafted local process or triggers a specific Office Click-To-Run code path that reuses freed memory. By grooming the heap and controlling the reclaimed object, they corrupt memory to run attacker-controlled code at elevated privilege, converting limited user access into high/SYSTEM-level control. No public POC is identified in the provided data; the local, low-complexity, no-user-interaction vector makes reliable weaponization plausible if an exploit is developed.