CVE-2026-85340: Microsoft Office Click-To-Run UAF Vulnerability

CVE-2026-85340 Overview

CVE-2026-85340 is a use-after-free vulnerability [CWE-416] in Microsoft Office Click-To-Run. The flaw allows an authorized local attacker to elevate privileges on an affected system. Microsoft published the advisory through its Security Response Center update guide.

The vulnerability requires local access and low privileges. No user interaction is needed to trigger the memory corruption. Successful exploitation yields high impact to confidentiality, integrity, and availability on the targeted host.

Critical Impact
An authorized local attacker can abuse a freed memory object in Microsoft Office Click-To-Run to execute code in a higher-privileged context and take control of the host.

Affected Products

Microsoft Office Click-To-Run (refer to the Microsoft advisory for the specific build and channel coverage)

Discovery Timeline

2026-10-13 - CVE-2026-85340 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85340

Vulnerability Analysis

The issue is a use-after-free condition within Microsoft Office Click-To-Run, the servicing and update framework used to install and maintain Office products. Click-To-Run runs privileged service components that handle update orchestration, virtualization, and installation tasks on the local system.

An authorized attacker running code locally can trigger a code path that references a memory object after it has been freed. When the freed allocation is reclaimed with attacker-controlled data, the subsequent dereference leads to control over a function pointer or object virtual table. This yields code execution within the context of the higher-privileged Click-To-Run component.

The attack requires only local access and low privileges, which matches typical post-compromise scenarios where an adversary already has an unprivileged foothold and seeks elevation.

Root Cause

The root cause is improper management of object lifetime within a Click-To-Run component. The code releases a heap object but retains or re-uses a pointer to the freed memory. Classified as [CWE-416], this pattern allows subsequent operations to read or write through a dangling pointer.

Attack Vector

Exploitation is local. An attacker with a standard user session on the host triggers the vulnerable Click-To-Run code path, races or shapes the heap to place controlled data in the reclaimed allocation, and redirects execution to escalate privileges. See the Microsoft CVE-2026-85340 Update Guide for vendor technical details.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism is described in prose because no sanitized exploit snippet has been released.

Detection Methods for CVE-2026-85340

Indicators of Compromise

Unexpected child processes spawned by Click-To-Run binaries such as OfficeClickToRun.exe or OfficeC2RClient.exe running under SYSTEM.
Abnormal writes to Office installation paths under %ProgramFiles%\Common Files\Microsoft Shared\ClickToRun\ by non-installer processes.
Crash events or Windows Error Reporting entries referencing the Click-To-Run service with access violation signatures.

Detection Strategies

Hunt for low-privileged user processes that trigger interprocess communication with the Click-To-Run service followed by privilege elevation of a related process tree.
Correlate Office update activity outside of scheduled maintenance windows with newly created privileged processes.
Flag loading of unsigned or user-writable modules into Click-To-Run processes.

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) and command-line logging on all Office endpoints.
Ingest Sysmon events for process access, image load, and named-pipe activity against Click-To-Run services.
Monitor Microsoft Defender and EDR telemetry for exploitation indicators tied to Office components.

How to Mitigate CVE-2026-85340

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-85340 Update Guide across all Office Click-To-Run installations.
Inventory endpoints running Office Click-To-Run and verify the deployed build matches the patched release.
Restrict local logon rights on servers and shared workstations to reduce the pool of accounts that can trigger local escalation.

Patch Information

Microsoft has issued servicing updates through the Click-To-Run channel. Confirm clients have received the latest cumulative update by validating the Office build number through File > Account > About or the Office Deployment Tool, and verify through the vendor advisory which build is remediated.

Workarounds

No vendor-supplied workaround is documented; applying the update is the supported remediation path.
Enforce least privilege and application control policies to limit arbitrary code execution by standard users while patches propagate.
Accelerate update rings for Office Click-To-Run so update deferral policies do not delay deployment of the fix.

bash

# Force an immediate Click-To-Run update check on Windows endpoints
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user updatepromptuser=true forceappshutdown=true