CVE-2026-88109: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88109) involves a use-after-free condition in Microsoft Office Click-To-Run, part of Microsoft 365 Apps for Enterprise. An authorized attacker with local access can exploit this flaw to elevate their privileges on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. Microsoft has published an official fix for this vulnerability and manages remediation for the cloud service. No active exploitation has been reported.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access on the affected system. This could lead to full compromise of the user context or system depending on the privileges escalated. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88109. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are required beyond applying the official patch.