CVE-2026-47293: Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Synopsis

Use-after-free vulnerability in Microsoft Office Click-To-Run allows a locally authenticated attacker to elevate their privileges on the affected system. The exploit is local-only and requires a low-privilege account, but no victim interaction is needed; once triggered, the attacker gains full read, write, and crash capability over the affected process context. Successful exploitation enables an attacker to escalate to higher privilege levels, potentially taking control of the host. A patched-image rebuild is available on HarborGuard for environments running affected versions of Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, or Office LTSC 2024.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials to trigger the vulnerability.

• Victim interactionNot required

  The exploit does not require a victim to take any action such as opening a file or clicking a link.

• Attack complexityDetail

  Attack complexity is high, meaning the exploit depends on specific timing, memory layout, or other environmental conditions that the attacker cannot fully control, reducing reliability.

Blast Radius

• Reads sensitive data accessible to the elevated process, including credentials, configuration files, and application data stored on the host.
• Modifies files, registry entries, or system configuration at the privilege level gained after escalation.
• Crashes or destabilizes the Office Click-To-Run process or dependent services, causing application-level disruption.
• Positions the attacker to persist on the host or pivot to further system resources by holding elevated privileges.