EUVD-2026-99053
GHSA-vjv8-9q3v-2whc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Access file to victim
-
ExploitUser opens malicious database
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to deliver a specially crafted Microsoft Office Access database file and requires the target user to open it (UI:R) - there is no autonomous network-service exploitation path despite the AV:N labeling. Reliable code execution further depends on overcoming AC:H conditions (heap layout grooming to control the overflow), and code runs only in the opening user's privilege context (S:U). Limiting factors: mandatory user interaction, high attack complexity, and the need for the Access application to be present and used to open the file. |
| Impact | Mixed-priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) indicates a network-delivered, unauthenticated code-execution flaw with full CIA impact, but two metrics materially suppress real-world risk: AC:H (high attack complexity, typical of heap grooming for reliable exploitation) and UI:R (the victim must open a malicious Access file). No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation. The 'network' vector here follows Microsoft's convention for file-delivered Office vulnerabilities rather than a remotely reachable listening service - exploitation still hinges on social engineering to deliver and have the user open a crafted database. Net: a genuinely dangerous RCE primitive if weaponized, but with no exploitation-probability evidence and strong user-interaction/complexity brakes, this is a patch-on-normal-cycle item rather than an emergency, absent any future KEV/POC change. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted Microsoft Access database file and lures a user into opening it. Parsing the malformed structure triggers a heap-based buffer overflow (CWE-122) that, after successful heap manipulation, executes arbitrary code in the user's security context. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute code in the security context of the user who opens a specially crafted Access database file. Exploitation is not autonomous despite the AV:N vector: the attacker must deliver the malformed file and persuade the victim to open it (UI:R), and reliable code execution further depends on heap-layout grooming to control the corrupted allocation (AC:H), so any code that runs inherits only the opening user's privileges (S:U). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the assessed risk is mixed-priority given the mandatory user interaction and high attack complexity.
RemediationAI
No vendor fix version was stated in the supplied intelligence, so vendor patch status for CVE-2026-105592 could not be confirmed from this data alone and the Microsoft MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105592) should be consulted for the current patched build and install that update or the applicable Microsoft 365 Apps update channel build as soon as it is published. Until a patch is confirmed and deployed, prioritise compensating controls that specifically break the delivery-and-open chain this bug depends on: block Access database file extensions (.accdb, .accde, .accdr, .mdb, .mde, .accdw) at email and web gateways and in endpoint download inspection, accepting that this breaks legitimate database-sharing workflows and requires an exception process for business-critical files; enforce Mark-of-the-Web and Protected View so that files originating from the internet or email open in a restricted, sandboxed Access view that does not fully load the document, noting that users may be prompted to click "Enable Editing" and that local copy/paste of file content can bypass the mark; deploy Microsoft Defender Application Guard for Office or equivalent containerisation where available, with the trade-off of slower file opening and possible compatibility issues with add-ins and macros; and reduce blast radius by ensuring users who routinely open Access files do not run with local administrator rights, so that any successful exploitation is confined to standard user privileges. Disabling or uninstalling Access across the estate is the most complete mitigation where the application is not required, at the cost of removing a business capability, and should be paired with application control (WDAC/AppLocker) rules that prevent Access sibling components from launching untrusted content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-122 heap-based buffer overflow, meaning a heap-allocated buffer is written past its bounds, corrupting adjacent heap metadata or objects. In Microsoft Office Access this class of bug is typically reached while parsing and interpreting the internal structures of a database file - the tables, forms, queries, macros, and embedded objects handled by the Access Database Engine (ACE, formerly the Jet engine) as a file is loaded and rendered. A crafted file that reaches the vulnerable parsing path can overwrite heap structures and, with sufficient grooming of the heap layout, redirect execution to attacker-controlled data; because the process is a desktop Office application, the executed code runs with the rights of the user who opened the document rather than SYSTEM. The CVSS:3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the attack is remote in the sense that the file can be delivered over a network (email, web download, chat, file share) and no credentials are needed, but it is gated behind a required user action and is rated high complexity, and the scope remains unchanged. No CPE strings or affected version ranges were included in the supplied intelligence, so the MSRC update guide remains the authoritative source for the exact builds and platforms affected; the report is credited to secure@microsoft.com and tagged as a Microsoft heap/buffer overflow issue.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over network but opened by victim (AV:N, UI:R, PR:N); heap grooming for reliable overflow justifies AC:H; code runs in-process giving full C/I/A:H within unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity vulnerability in Microsoft Office Access could allow an attacker to execute malicious code on a user's system if they open a specially crafted database file. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, leaving organizations exposed to potential data theft or system compromise. Security leadership should prioritize mitigating this risk through user education and file-handling controls.
Block Access database file attachments at the email gateway, disable opening of Access files from untrusted locations, enable Attack Surface Reduction rules to block Office child processes, and implement application sandboxing such as Microsoft Defender Application Guard.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB