CVE-2026-70276: Microsoft Office Click-To-Run UAF Vulnerability

CVE-2026-70276 Overview

CVE-2026-70276 is a use-after-free vulnerability [CWE-416] in Microsoft Office Click-To-Run. The flaw allows an authorized local attacker to elevate privileges on an affected system. Exploitation requires low privileges and no user interaction, but attack complexity is high because the attacker must win a timing-dependent condition against freed memory. Successful exploitation yields high impact to confidentiality, integrity, and availability. Microsoft published the advisory on October 13, 2026.

Critical Impact

An authenticated local user can trigger a use-after-free in Microsoft Office Click-To-Run to execute code at elevated privileges, enabling full compromise of the affected host.

Affected Products

• Microsoft Office Click-To-Run (see the Microsoft Update Guide for the authoritative build list)

Discovery Timeline

• 2026-10-13 - CVE-2026-70276 published to the National Vulnerability Database (NVD)
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70276

Vulnerability Analysis

The vulnerability resides in Microsoft Office Click-To-Run (C2R), the streaming and servicing component that installs and updates Office products. A use-after-free condition [CWE-416] occurs when the component references a memory object after it has been released. An attacker who already holds a low-privilege account on the system can trigger the dangling reference and manipulate the reclaimed allocation. Because Click-To-Run service components run with elevated rights, a successful exploit executes attacker-controlled logic in a higher integrity context. The result is local privilege escalation on the targeted Windows host.

Root Cause

The defect stems from improper lifetime management of a heap object inside Office Click-To-Run. Code paths continue to use a pointer after the referenced memory has been freed, allowing reallocation of the slot with attacker-controlled data before the stale reference is dereferenced. Microsoft has not published implementation-level details. Consult the Microsoft Update Guide advisory for vendor-authoritative technical content.

Attack Vector

The attack vector is local. The adversary must first obtain code execution as a standard user on the target machine, for example through phishing, a secondary vulnerability, or stolen credentials. The attacker then interacts with the Click-To-Run service in a manner that forces the vulnerable allocation sequence. High attack complexity reflects the need to win a race or precisely groom the heap so that the freed slot is reclaimed with controlled data before reuse. No user interaction is required beyond the attacker's own activity.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Microsoft Update Guide for additional technical details.

Detection Methods for CVE-2026-70276

Indicators of Compromise

• Unexpected child processes spawned by OfficeClickToRun.exe or related Click-To-Run service binaries running under NT AUTHORITY\SYSTEM.
• Crash events referencing Office Click-To-Run modules in the Windows Application event log, particularly repeated access violations consistent with heap corruption.
• Low-privileged user accounts suddenly performing actions that require administrative rights shortly after interacting with Office components.

Detection Strategies

• Hunt for anomalous process lineage where OfficeClickToRun.exe launches command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
• Correlate token elevation events with the originating process to identify unauthorized privilege transitions from standard user to SYSTEM.
• Use behavioral analytics to flag heap-grooming patterns, including rapid repeated allocations and frees against Office service components.

Monitoring Recommendations

• Enable Microsoft Defender tamper protection and ensure Office telemetry is forwarded to a centralized SIEM for correlation.
• Monitor changes to Office installation and update directories under %ProgramFiles%\Common Files\Microsoft Shared\ClickToRun\.
• Alert on service restarts or configuration changes affecting the ClickToRunSvc Windows service outside of scheduled maintenance windows.

How to Mitigate CVE-2026-70276

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Update Guide to all systems running Office Click-To-Run.
• Verify that automatic Office updates are enabled so Click-To-Run can pull the fixed build without manual intervention.
• Audit local accounts and remove unnecessary interactive logon rights on systems that host Office installations.

Patch Information

Microsoft addressed CVE-2026-70276 through the standard Office Click-To-Run servicing channel. Administrators should confirm that endpoints have received the latest Office build after the October 13, 2026 publication date. Refer to the Microsoft Update Guide for build numbers mapped to each update channel, including Current, Monthly Enterprise, and Semi-Annual Enterprise channels.

Workarounds

• No vendor-documented workaround exists; patching is the required remediation path.
• Enforce the principle of least privilege so standard users cannot stage exploitation prerequisites on sensitive hosts.
• Restrict interactive access to shared or multi-user systems where Office is installed until updates are deployed.

# Verify Office Click-To-Run version on a Windows endpoint
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport

# Trigger an on-demand Click-To-Run update
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user