A use‑after‑free condition within the Microsoft Office Click‑To‑Run component allows an authorized attacker to elevate privileges locally. By operating on memory that has already been freed, an attacker can hijack program control flow and execute actions that require higher rights, effectively bypassing standard permission checks. This vulnerability is an access‑control flaw classified as CWE‑284, potentially compromising system integrity.

The vulnerability affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024. Version specifics are not disclosed, so all current releases are potentially impacted until a patch is applied.

The CVSS base score of 8.8 indicates a high severity scenario. Although the EPSS score is less than 1% and the issue is not listed in the KEV catalogue, the flaw remains exploitable by users with local or authenticated access. The most likely attack vector is local, requiring the attacker to be authenticated or have physical access to the machine, making the vulnerability pertinent to insider threats or compromised user accounts.