CVE-2026-97774: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97774, is a TOCTOU race condition in Microsoft Office Click-To-Run within Microsoft 365 Apps for Enterprise. It enables an authorized local attacker to elevate privileges by exploiting a timing issue between the check and use of a resource. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service.

An authorized local attacker can exploit this race condition to elevate privileges, potentially gaining higher access rights than intended. This can lead to full compromise of confidentiality, integrity, and availability of the affected system components within Microsoft 365 Apps for Enterprise.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97774.