Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
According to the CVSS metric, the attack vector is local (AV:L). How could an attacker exploit this elevation of privilege vulnerability? An attacker could exploit this elevation of privilege vulnerability by first establishing a foothold on the local system such as opening a malicious document or gaining access through another local vector and then leveraging the flaw to break out of the Protected View sandbox. Protected View is intended to isolate untrusted content in a restricted environment; however, successful exploitation would allow the attacker to escape these restrictions and execute code with elevated privileges on the host system. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Ben Lichtman with Microsoft