A time‑of‑check time‑of‑use race condition in Microsoft Office Click‑To‑Run enables an attacker who already has local authorization to gain elevated privileges. The flaw allows the attacker to replace or modify a file, program, or resource between the moment it is checked for permissions and the moment it is used, effectively bypassing the intended security controls. As a result, the attacker can execute arbitrary code or perform administrative actions without proper authorization. The weakness is classified as CWE‑367, a race condition flaw.

Microsoft 365 Apps for Enterprise, part of the Microsoft 365 Apps suite, are affected by this vulnerability.

The CVSS score of 7 indicates a medium‑to‑high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires local access and an authorized user role to trigger the race condition. If exploited, the local attacker could elevate their privileges to a full administrative level on the machine, enabling further attacks or persistence. The lack of an EPSS or KEV listing suggests that, as of this analysis, widespread exploitation is not documented, but the potential impact remains significant for affected systems.