Read the docs
TI-2026-73186 Aliases CVE-2026-97774GHSA-x7rq-wc5m-cvmj

Race condition in Microsoft Office Click-To-Run allows privilege escalation

Priority LOW 32CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Microsoft 365 Apps for Enterprise from 16.0.1, before the fixed build listed in Microsoft's Office security release notes, contains a time-of-check time-of-use race condition (CWE-367) in Microsoft Office Click-To-Run. An authorized local attacker with low privileges can exploit the race to gain higher privileges, and exploitation is of high complexity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed Microsoft 365 Apps for Enterprise (Microsoft): https://aka.ms/OfficeSecurityReleases

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft 365 Apps for Enterprise16.0.1 to before https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesPatch availableCNA
  • Microsoft 365 Apps for Enterprise VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

Microsoft lists the fixed builds for Microsoft 365 Apps for Enterprise in its Office security release notes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Microsoft 365 Apps for Enterprise (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-97774
  2. 2026-10-13 Alias added: GHSA-x7rq-wc5m-cvmj

References

Patch 1

  • TI-2024-14173 Microsoft Outlook Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25471 Microsoft Project Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2026-17368 Microsoft Word Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
  • TI-2026-17363 Microsoft Office Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
See all 935 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences