Improper access control within the Microsoft Office Click‑To‑Run component permits an authorized user to gain elevated privileges on a local Windows system. By bypassing standard permission checks, an attacker can execute additional actions that require higher rights, potentially compromising the integrity of the system. This weakness is a classic access‑control flaw classified as CWE‑284.

The vulnerability affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024. Version specifics are not disclosed, so all current releases are potentially impacted until a patch is applied.

The CVSS base score of 8.8 indicates a high severity scenario. Although an EPSS value is unavailable, the lack of a KEV listing does not mitigate the risk; the flaw remains exploitable by users who already possess some level of local access. The most likely attack vector is local, requiring the attacker to be authenticated or have physical access to the machine, making the vulnerability pertinent to insider threats or compromised user accounts.