Product:
Microsoft Office Click-To-Run
Summary
Improper access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. This vulnerability can lead to significant security risks as it enables unauthorized actions by users with limited access. The issue arises from insufficient checks on user permissions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2026-40420 |
Exploitation
To exploit this vulnerability, an attacker with local access to the system can manipulate the application to gain elevated privileges. This can be achieved by executing specially crafted commands or scripts that bypass the access control mechanisms in place. Once the attacker has elevated privileges, they can perform unauthorized actions that could compromise the system’s integrity and confidentiality.
Affected Products
- Microsoft Office Click-To-Run: A service that allows users to install and update Microsoft Office applications.
Mitigation
To mitigate this vulnerability, users should ensure that they are running the latest version of Microsoft Office Click-To-Run and apply any available security updates. Additionally, restricting local access to systems and implementing strict user permission policies can help reduce the risk of exploitation.