A use‑after‑free flaw exists in Microsoft Office Click‑To‑Run that lets an authorized local attacker elevate their privileges. The vulnerability allows the attacker to execute code with higher system permissions, potentially compromising the entire machine. The weakness is a classic memory misuse error classified as CWE‑416.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Version details are not specified in the advisory, so any revision of these products may be vulnerable until the fix is released.

With a CVSS score of 7.8, the vulnerability is considered high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, implying limited public exploitation data. The attack requires a local, authorized context—an attacker who already has user access to the system—and depends on the ability to trigger the use‑after‑free condition in the Click‑To‑Run component.