Office Click-To-Run CVE-2026-97774

Requires an existing local, authenticated low-privileged session on a host running Microsoft Office / Microsoft 365 Apps installed via Click-To-Run (PR:L, AV:L). The attacker must win a time-of-check-to-time-of-use race against a Click-To-Run file operation, substituting an attacker-controlled file in the window between validation and use - the AC:H rating reflects this timing dependency, meaning exploitation is probabilistic and may require repeated attempts. Limiting factors: no remote/network vector, no path for unauthenticated attackers, and no user interaction by a victim (UI:N) but a prior local foothold is mandatory; reliability is reduced by the narrow race window.

CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, describing a local elevation-of-privilege flaw rather than a remotely reachable one. The attack vector is local (AV:L) and requires an already-authenticated low-privileged user (PR:L), which substantially constrains real-world reach - an attacker must first have a foothold on the host. Attack complexity is High (AC:H), consistent with a CWE-367 TOCTOU race condition whose exploitation depends on reliably winning a narrow timing window, so weaponization is non-trivial and reliability is typically low. No EPSS score was provided in the input, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public exploit code identified at time of analysis, meaning there is no evidence of active exploitation or available POC. On balance this is a meaningful but not emergency-priority issue: the high CIA impact (C:H/I:H/A:H, consistent with gaining SYSTEM-level privileges) is offset by local-only access, low-privilege-but-authenticated prerequisite, and a high-complexity race that resists mass automation. Note a data conflict: the input Tags include 'Information Disclosure', but the description and CVSS impact describe privilege elevation, not disclosure - verify tagging with the vendor advisory.

An attacker who already has a low-privileged authenticated session on a Windows host running Microsoft 365 Apps (Click-To-Run) runs a local tool that repeatedly triggers Click-To-Run file operations and swaps a checked file for a malicious one between the time-of-check and time-of-use. By winning this TOCTOU race, the attacker causes the higher-privileged Click-To-Run component to act on attacker-controlled content, elevating to SYSTEM. No public exploit code has been identified at time of analysis, and the race (AC:H) typically requires multiple attempts to succeed.