Microsoft Office Click-to-Run: Local privilege escalation via use-after-free
Summary
A use-after-free flaw in Microsoft Office Click-to-Run allows an attacker with local access and a low-privilege account to elevate privileges on the affected machine. The CVSS vector (AV:L/AC:L/PR:L/UI:N) shows no remote or unauthenticated attack path. The main risk is use as a second stage after malware or a phished user has code running as that user. NVD scores the flaw 7.8 (High), while VulDB and EUVD show lower scores.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the October 13, 2026 update (upper bound unconfirmed)
- Office LTSC 2021: 16.0.1 to before 16.0.14334.20974 (secondary source, unconfirmed)
- Office LTSC 2024: 16.0.0 to before 16.0.17932.21056 (secondary source, unconfirmed)
- Office 2019: Unknown, conflicting build numbers in Microsoft sources
Fixed in
- Office LTSC 2021: 16.0.14334.20974 (not yet confirmed by the MSRC advisory)
- Office LTSC 2024: 16.0.17932.21056 (not yet confirmed by the MSRC advisory)
- Microsoft 365 Apps and Office 2019: Unknown, verify on the MSRC page
Workaround
Unknown. No workaround is confirmed; the vendor remedy is the security update.
Exploitation
- No evidence of exploitation in the wild found
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in CISA KEV according to Strix
- No public proof of concept found
Our recommendation
- Install the Office security updates released on October 13, 2026 on all Microsoft 365 Apps and Office perpetual clients
- Verify the exact fixed build on the MSRC page before closing the ticket
- Check Office 2019 and Office 2021 builds separately, because the sources conflict and Office 2021 is at end of support
- Monitor the MSRC page and CISA KEV; raise priority if exploitation is reported
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-85340 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- Microsoft Office 2019 update history learn.microsoft.com
- OpenCVE: CVE-2026-85340 app.opencve.io
- Strix: CVE-2026-85340 www.strix.ai
- Qualys October 2026 Patch Tuesday review blog.qualys.com
- VulDB: CVE-2026-85340 vuldb.com
- Office Watch: October 2026 Office critical fixes office-watch.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:26.
Original description (NVD)
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.