CVE-2026-47293 is a use-after-free vulnerability (CWE-416) in Microsoft Office Click-To-Run component of Microsoft 365 Apps for Enterprise. This flaw allows an authorized local attacker to elevate privileges by exploiting the improper handling of memory after it has been freed. The vulnerability has a CVSS 3.1 base score of 7.0, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. The affected version explicitly includes 16.0.1.

An authorized local attacker can exploit this use-after-free vulnerability to elevate privileges, potentially gaining higher access rights than intended. The vulnerability affects confidentiality, integrity, and availability of the affected system. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47293 for detailed patching instructions and ensure their Microsoft 365 Apps for Enterprise environment is updated to the fixed version.