Brief Summary: CVE-2026-35436 Elevation of Privilege in Microsoft Office Click-to-Run via Access Control Weakness

Introduction

An insufficient access control flaw in Microsoft Office Click-to-Run's shared infrastructure lets a low-privilege local attacker escalate to SYSTEM and escape the AppContainer sandbox. It has a CVSS 3.1 base score of 8.8. Microsoft 365 is deployed across hundreds of millions of endpoints, including 89 million consumer subscribers, and its commercial seat base is growing at 6 percent year over year, so the potential blast radius is substantial even though no exploitation has been observed yet.

Technical Information

The vulnerability is in the shared Click-to-Run infrastructure of Microsoft Office, not in any individual application such as Word or Excel. The root cause is classified as CWE-1220: Insufficient Granularity of Access Control. In practice, the software does not enforce permission checks at the fine-grained level needed to restrict operations inside its execution environment.

The full CVSS 3.1 vector string is:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Five elements of this vector stand out:

• Attack Vector (Local): The attacker must already have basic user access on the target system. Remote exploitation is not possible.
• Attack Complexity (Low): No special conditions or race conditions are needed.
• Privileges Required (Low): Standard user privileges are enough to trigger the flaw.
• User Interaction (None): No action from a legitimate user is required.
• Scope (Changed): This is the most consequential element. A successful exploit affects resources beyond the security boundary that the vulnerable component manages.

The "Changed" scope means exploitation escapes a contained execution environment, specifically the AppContainer isolation boundary. AppContainer is a Windows sandboxing mechanism that restricts what processes running inside it can do. Office Click-to-Run components run inside this sandbox to limit the damage a compromised process can cause. A successful exploit of CVE-2026-35436 would let an attacker operating within the Office Click-to-Run AppContainer break out of that sandbox and gain SYSTEM-level privileges on the host.

Attack Flow

Based on the available advisory details, the exploitation path would run as follows:

1. An attacker with low-privilege local access to a system running a vulnerable version of Office Click-to-Run identifies the Click-to-Run service infrastructure.
2. The attacker interacts with the Click-to-Run components in a way that exploits the insufficient access control checks. Because the access control lacks the necessary granularity, operations that should be restricted to higher privilege levels are accessible.
3. Through these improperly gated operations, the attacker escalates from a sandboxed, low-privilege context to SYSTEM.
4. With SYSTEM privileges and outside the AppContainer boundary, the attacker gains full control over the confidentiality, integrity, and availability of the host system.

The High impact ratings on all three CIA triad dimensions reflect that complete control.

Microsoft explicitly states that the Preview Pane is not an attack vector for this vulnerability. That narrows the attack surface to direct local interaction with the Click-to-Run components and rules out passive document rendering, which matters for risk assessment.

Patch Information

Microsoft released an official fix for CVE-2026-35436 on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The MSRC advisory lists the Remediation Level as "Official Fix," which means a complete vendor solution is available. No workarounds or hotfixes outside the official patch have been publicly disclosed.

Office Click-to-Run uses a streaming update mechanism rather than traditional standalone KB patches, so the fix ships as part of the updated Office build for each servicing channel. There is no single KB article to download. Administrators instead have to verify that endpoints are running the patched build numbers or later.

Microsoft applied the fix to the Office suite component, which fits with the vulnerability sitting in the shared Click-to-Run infrastructure itself. These products received the update, each through its own Click-to-Run update channel:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit)
• Microsoft Office LTSC 2024 (32 bit and 64 bit)
• Microsoft Office LTSC 2021 (32 bit and 64 bit)
• Microsoft Office 2019 (32 bit and 64 bit)

The fixed build numbers for each channel are:

To verify remediation, confirm the exact build number running on each endpoint rather than checking whether a particular KB is installed. In any Office application, go to File > Account and check the version listed under "About." Organizations using Microsoft 365 Apps should make sure their update channels are current and that no devices have been deferred past these fixed builds.

Affected Systems and Versions

The vulnerability affects every Microsoft Office installation that uses the Click-to-Run delivery mechanism. The affected products are:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit), builds prior to Version 2604 (Build 19929.20162) on Monthly Enterprise Channel, or prior to Version 2604 (Build 19929.20164) on Current Channel
• Microsoft Office LTSC 2024 (32 bit and 64 bit), builds prior to Version 2408 (Build 17932.20776) for Volume Licensed, or prior to Version 2604 (Build 19929.20164) for Retail
• Microsoft Office LTSC 2021 (32 bit and 64 bit), builds prior to Version 2108 (Build 14334.20670) for Volume Licensed, or prior to Version 2604 (Build 19929.20164) for Retail
• Microsoft Office 2019 (32 bit and 64 bit), builds prior to Version 1808 (Build 10417.20132) for Volume Licensed

The Semi-Annual Enterprise Channel is also affected for builds prior to Version 2508 (Build 19127.20646).

Traditional MSI-based Office installations are not affected, because the vulnerability is specific to the Click-to-Run infrastructure.

Vendor Security History

Microsoft releases security updates on a regular monthly cadence. The May 2026 cycle addressed 120 security flaws across its products. None of them was a zero-day, so all 120 flaws, including CVE-2026-35436, were patched before any public disclosure or observed exploitation.

References

• NVD Entry for CVE-2026-35436
• Microsoft Security Response Center Advisory
• Microsoft 365 Apps Security Update Release Notes
• Zero Day Initiative: May 2026 Security Update Review
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Microsoft FY25 Q4 Productivity and Business Processes Performance