CVE-2026-47293: Microsoft Office Click-To-Run Privilege Escalation Vulnerability

Technical summary

The vulnerability (CWE-416: Use After Free) resides in the Click-To-Run deployment infrastructure used by Microsoft 365 Apps and Office desktop editions. Click-To-Run manages application lifecycle, updates, and repair operations with elevated privileges. A flaw in memory allocation and deallocation during one of these operations allows an authenticated, unprivileged user to reference freed memory, leading to code execution in a privileged context. The CVSS 3.1 score of 7.0 (HIGH) reflects high confidentiality, integrity, and availability impact, but requires low privileges and a higher attack complexity on the local attack surface.

Business impact

Successful exploitation enables privilege escalation from a standard user to administrator on affected Office installations. This can facilitate lateral movement within the network, unauthorized access to sensitive documents, tampering with Office configurations, installation of persistence mechanisms, or data exfiltration. In environments where Office is widely deployed and user account hygiene varies, this represents a meaningful post-compromise risk that could amplify the impact of credential theft, phishing, or other account compromise scenarios.

Affected systems

Microsoft Office Click-To-Run is the default deployment mechanism for Microsoft 365 Apps, Office 2021, and Office 2024. This affects both subscription-based Microsoft 365 deployments and perpetual license versions. Organizations running any of these editions—whether on Windows 10, Windows 11, or Windows Server—should assume their installations are in scope until patches are applied. The vulnerability does not affect Office versions using traditional MSI installation.

Exploitability

Exploitation requires an attacker to possess valid login credentials and local machine access. The attack complexity is rated as high, meaning successful exploitation requires specific conditions or timing. There is no indication of public exploit code or active in-the-wild exploitation as of the vulnerability's publication date. However, the local-only nature and credential requirement make this particularly relevant in scenarios involving disgruntled insiders, compromised user accounts, or physical device access—not random internet-facing attacks.

Remediation

Microsoft has issued security updates for all affected Office versions. Organizations should apply patches to Microsoft 365 Apps and Office 2021/2024 installations as part of standard update cycles. For Microsoft 365 Apps, updates are often deployed automatically; verify that automatic updates are enabled and that devices have checked in recently. For on-premises Office editions, patches must be applied through Windows Update, Microsoft Update, or the Office deployment toolkit. Test patches in a lab environment before broad rollout to ensure compatibility with organizational customizations.

Patch guidance

Consult Microsoft's official security advisory for CVE-2026-47293 to identify specific patch versions for each affected product version. Microsoft 365 Apps typically receive cumulative monthly updates; ensure devices are configured to receive updates promptly. Office 2021 and 2024 require explicit patching through Windows Update or WSUS. Verify patch deployment status using your organization's device management platform (Intune, Configuration Manager, or third-party tools). Once patched, the use-after-free condition is eliminated and privilege escalation via this vector is prevented.

Detection guidance

Monitor Windows Event Logs on Office-running systems for suspicious Click-To-Run process behavior, particularly unexpected elevation attempts or unusual parent-child process chains involving OfficeClickToRun.exe or related installers. Endpoint Detection and Response (EDR) solutions should flag unusual memory access patterns or heap corruption indicators during Office update or repair operations. Check for unauthorized local administrator account creation shortly after Office updates. Because exploitation requires local access and credentials, focus detection on anomalous lateral movement or privilege escalation chains that follow account compromise alerts. Audit successful privilege elevation attempts on systems where the vulnerability remains unpatched.

Why prioritize this

This vulnerability merits urgent attention because it enables straightforward privilege escalation from standard user to administrator on widely deployed Office installations. Although it requires local access and valid credentials, the combination of those factors is common in enterprise environments affected by phishing, password reuse, or insider threats. Organizations with high sensitivity to post-compromise privilege escalation, strong endpoint monitoring, or compliance requirements for rapid patching should treat this as a near-term priority. The HIGH CVSS score and prevalence of Click-To-Run installations justify prioritization alongside other active high-severity flaws.

Risk score, explained

CVE-2026-47293 receives a CVSS 3.1 score of 7.0 (HIGH) based on the following factors: local attack vector (AV:L) limits exposure to device-local attackers; low privilege requirement (PR:L) reflects that standard users can trigger the vulnerability; high attack complexity (AC:H) indicates exploitation requires specific conditions; however, full impact across confidentiality, integrity, and availability (C:H/I:H/A:H) results from the ability to execute arbitrary code as administrator. The score appropriately balances the severity of privilege escalation against the practical barriers to exploitation. The absence of KEV listing and active exploitation reporting does not reduce the intrinsic severity, but may lower tactical urgency relative to actively weaponized vulnerabilities.

Frequently asked questions