Microsoft Office Click-To-Run Privilege Escalation Vulnerability

A use-after-free vulnerability has been identified in Microsoft Office Click-To-Run, allowing an authorized attacker to locally elevate privileges. This vulnerability affects multiple Office products, including Microsoft Office LTSC 2024, Microsoft 365 Apps for Enterprise, Microsoft Office 2019, and others, across both 32-bit and 64-bit editions.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain SYSTEM privileges.

Remediation

Users can download the security update for this vulnerability through the Microsoft Update Catalog. For Microsoft Office LTSC 2024, instructions are available on the Microsoft 365 Apps Security Updates page. Similar guidance can be found for Microsoft Office 2019.