cve-2026-35436

CVE-2026-35436 is an Important elevation-of-privilege vulnerability in Microsoft Office Click-to-Run, disclosed on May 12, 2026. It allows a low-privileged local attacker to escape a contained execution environment and gain SYSTEM privileges on affected Office installations. The vulnerability lies in Office's update and virtualization plumbing, making it part of the Windows privilege boundary. For administrators, the key concern is ensuring managed Office channels converge on the fixed builds promptly. This tag covers discussions about the vulnerability's impact, mitigation, and patching strategies for enterprise environments.