A use‑after‑free flaw in Microsoft Office Click‑To‑Run permits a local, authorised attacker to gain higher privileges. The flaw, classified as CWE‑416, allows the attacker to access functions or resources reserved for privileged users, potentially enabling further exploitation of the system.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.

With a CVSS score of 7, the vulnerability presents a high‑severity concern for local users. Exploitation requires the attacker to have a user account on the machine and the ability to interact with the Office client, meaning a local attack vector is inferred. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely observed in the wild but could still be exploited in targeted scenarios.