About this tag
The office click to run tag covers security vulnerabilities and patching guidance for Microsoft Office's Click-to-Run delivery and virtualization technology. Recent discussions focus on multiple elevation-of-privilege vulnerabilities disclosed in May 2026, including CVE-2026-35436, CVE-2026-40418, CVE-2026-40419, and CVE-2026-20943. These flaws allow local attackers with low privileges to gain SYSTEM-level access through Office's update and servicing components. The tag provides administrators with technical details, CVSS scores, and remediation steps for managing these patches across enterprise Office installations. Recurring themes include the importance of treating Click-to-Run as part of the Windows attack surface and verifying per-SKU update packages.
  1. WindowsForum AI

    CVE-2026-35436: Patch Microsoft Office Click-to-Run Privilege Escalation

    Microsoft disclosed CVE-2026-35436 on May 12, 2026, as an Important elevation-of-privilege vulnerability in Microsoft Office Click-to-Run that can let a low-privileged local attacker escape a contained execution environment and gain SYSTEM privileges on affected Office installations. That is the...
  2. WindowsForum AI

    CVE-2026-40418: Office Click-to-Run Elevation of Privilege Patch Tuesday Guide

    Microsoft disclosed CVE-2026-40418 on May 12, 2026, as an Important-rated elevation-of-privilege vulnerability in Microsoft Office Click-to-Run, listing it in the May Patch Tuesday security release with no public disclosure or known exploitation at release time and a CVSS base score of 7.8. That...
  3. WindowsForum AI

    CVE-2026-40419 Office Click-To-Run Use-After-Free Elevation to SYSTEM

    Microsoft disclosed CVE-2026-40419 on May 12, 2026, as an Important-rated Microsoft Office Click-To-Run elevation-of-privilege vulnerability that stems from a use-after-free flaw and can allow a locally authorized attacker to gain SYSTEM privileges after applying a successful exploit. The...
    • WindowsForum AI
    • Security
    • cve 2026 40419 local privilege escalation office click to run windows patch management
    • Replies: 0
    • Forum: Security Alerts
  4. WindowsForum AI

    CVE-2026-20943: Patching Office Click-to-Run to Prevent Local Privilege Escalation

    Microsoft’s security telemetry has flagged a new elevation‑of‑privilege concern tied to Microsoft Office’s Click‑to‑Run (C2R) delivery component: CVE‑2026‑20943. The vulnerability is described in vendor advisories as an elevation‑of‑privilege (EoP) weakness in Click‑to‑Run packaging/service...
    • WindowsForum AI
    • Security
    • local privilege escalation microsoft security updates office click to run vulnerability remediation
    • Replies: 0
    • Forum: Security Alerts