Microsoft Access CVE-2026-105595

Exploitation requires the victim to open an attacker-supplied, specially crafted Microsoft Access database file (CVSS UI:R) - there is no server-side or passive trigger, so social engineering or file delivery is a hard prerequisite. No prior authentication is needed (PR:N) and no special Access configuration is cited in the description, but code executes only in the context of the user who opens the file, which limits impact on hardened/least-privilege desktops. The primary limiting factors are the mandatory user interaction and the need to convince a target to open the malicious document.

This is a genuinely serious but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated code execution with high impact across confidentiality, integrity, and availability - but the UI:R flag is decisive: exploitation requires a victim to open a malicious file, so this is not wormable or self-propagating. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation remains theoretical in the available data: the status is 'no public exploit identified at time of analysis.' There is also a signal conflict worth flagging: the underlying weakness is CWE-125 (out-of-bounds READ), and the tags include 'Information Disclosure,' yet the description and CVSS (I:H/A:H) claim full code execution - out-of-bounds reads more typically yield info-leak, so the leap to RCE should be verified against the Microsoft advisory, as an OOB read alone usually does not grant C:H/I:H/A:H without a corroborating memory-corruption primitive. Net: a real patch-priority item for any Office/Access estate because of the high impact and low attack complexity, but the mandatory user interaction and absence of exploitation evidence place it below actively-exploited or zero-click bugs.

An attacker emails or hosts a specially crafted Microsoft Access database file and lures a user into opening it. When Access parses the malformed structure, an out-of-bounds read is triggered that the attacker leverages to execute arbitrary code in the context of the current user. No public proof-of-concept was identified at the time of analysis, and the network attack vector relies entirely on the victim opening the file (UI:R).