CVE-2026-97774 in Office Click-To-Run
Summary
by MITRE • 10/14/2026
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described constitutes a classic Time-of-Check-Time-of-Use, or TOCTOU, race condition within the Microsoft Office Click-to-Run installation and update mechanism. This architectural flaw arises from a fundamental inconsistency in how the software validates security attributes before executing privileged operations. Specifically, the system performs an initial check to verify that certain files or directories possess specific permissions or ownership states deemed safe for modification by standard users. However, between this verification step and the subsequent use of those resources during installation or update processes, there exists a narrow but exploitable window where the state of these filesystem objects can be altered by another process running with lower privileges. This temporal gap allows an attacker to manipulate the target files, effectively tricking the elevated Office Click-to-Run service into operating on maliciously prepared assets that were deemed safe during the initial check phase.
From a technical perspective, this flaw is rooted in improper synchronization of resource access and validation logic within the application's installer components. The vulnerability aligns with Common Weakness Enumeration identifier CWE-367, which defines TOCTOU race conditions as errors where multiple processes or threads can concurrently access shared resources without proper locking mechanisms to ensure atomicity. In this context, the Office Click-to-Run service runs with elevated privileges to facilitate seamless updates and installations for end-users. When it encounters a file path that requires modification, it checks if the user has write permissions. If an attacker creates a symbolic link or modifies directory permissions in the interim window between the check and the actual write operation, the privileged process may inadvertently overwrite critical system files or execute arbitrary code under its high-privilege context. This mechanism bypasses standard access control lists because the validation is not atomic with respect to the file state changes introduced by concurrent processes.
The operational impact of this vulnerability is severe due to the potential for local privilege escalation. An authorized attacker, who already possesses valid credentials on a system running Microsoft Office Click-to-Run, can leverage this race condition to execute arbitrary code with SYSTEM-level or equivalent administrative privileges. This effectively breaks the principle of least privilege by allowing a standard user account to gain full control over the operating system. Once elevated, an attacker could install persistent backdoors, exfiltrate sensitive data, modify security configurations, or use the compromised machine as a pivot point for further network attacks. The existence of this flaw undermines the integrity and confidentiality guarantees provided by the Windows operating system's access control model, particularly in environments where Office Click-to-Run is actively used for frequent updates or installations.
Mitigation strategies primarily involve applying vendor-supplied patches that address the underlying synchronization issues within the Office Click-to-Run service. These updates typically replace non-atomic check-and-set operations with atomic file handling routines or implement stricter validation checks immediately prior to execution, thereby eliminating the race window. In addition to patching, administrators should enforce strict filesystem permissions on directories associated with Office installation and temporary files, ensuring that standard users cannot create symbolic links or modify directory structures in those locations. Furthermore, enabling advanced auditing for privilege escalation events can help detect attempts to exploit this vulnerability in real-time. Organizations must also ensure that all systems are updated regularly to incorporate the latest security fixes from Microsoft, as unpatched instances remain vulnerable to exploitation by any authenticated user on the affected machine. This incident highlights the critical importance of atomic operations and rigorous synchronization in privileged software components to prevent race condition-based privilege escalation attacks.