CVE-2026-88109
7.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
A local attacker with standard user access can elevate privileges to SYSTEM or administrator on the host. Exploitation requires existing local credentials or code execution, with no user interaction required.
Root cause
A use-after-free condition in Microsoft Office Click-To-Run exposes dangling pointers in memory that can be manipulated during local execution.
Affected systems
Microsoft Office Click-To-Run (exact version ranges not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the latest Microsoft Office security update via Click-To-Run or Microsoft Endpoint Configuration Manager; no interim workaround or configuration change is documented.
$ "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update userAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.