EUVD-2026-99056
GHSA-wfmv-x74h-pcxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Access file via email/web
-
DeliveryUser opens malicious file
-
ExploitTrigger heap buffer overflow in Access parser
-
ExecutionExecute arbitrary code in user context
-
ImpactCompromise confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open an attacker-supplied malicious Microsoft Access file, triggering the heap overflow during file parsing (CVSS UI:R confirms required user interaction). No authentication is needed (PR:N) and the attack is deliverable over a network (AV:N) with low complexity (AC:L). The primary limiting factor is the user-interaction requirement - the attacker cannot trigger the flaw without convincing a victim to open the crafted file - and the target host must have Microsoft Office Access installed; the scope is unchanged (S:U), so impact is confined to the victim's user context. |
| Impact | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated code-execution flaw whose only gating factor is required user interaction (UI:R) - consistent with a malicious-document attack rather than a server-side wormable bug. No EPSS probability, CISA KEV listing, or public POC is present in the supplied data, so there is currently no public exploit identified and no evidence of active exploitation; the risk therefore rests on CVSS metrics alone. The signals are internally consistent (network vector + UI:R matches a file-parsing RCE in a desktop application), with no contradiction between the description and the vector. This is a credible high-priority patch target for environments running Microsoft Access because of the full C/I/A impact and no authentication requirement, but the UI:R requirement and absence of KEV/POC/EPSS data place it below confirmed in-the-wild threats - treat as 'patch promptly' rather than 'emergency,' and re-evaluate if Microsoft or CISA later report exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Microsoft Access database or document file and delivers it via email or a web download; when a user opens it, the heap-based buffer overflow (CWE-122) is triggered during parsing, allowing arbitrary code execution in the user's context. No public exploit code is identified at time of analysis, and successful attack depends on the victim opening the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Office Access occurs when a victim opens an attacker-supplied, specially crafted Access database file that triggers a heap-based buffer overflow during file parsing (CWE-122). The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): it is network-deliverable, low-complexity and needs no authentication, but is gated entirely by the requirement that a user open the malicious document, and scope is unchanged so code runs in the victim's user context rather than granting system-wide control. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
RemediationAI
Apply the Microsoft security update for CVE-2026-105596 through Microsoft Update, Windows Update for Business, Microsoft 365 Apps update channels, or the Microsoft Update Catalog, using the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105596) to determine the exact fixed build for each affected Office release - patch status and the specific fixed version are published there, and an exact fix version is not specified in the available input data. Until the update is deployed, reduce exposure by removing or restricting the ability to open untrusted Access files: use the Trust Center File Block Settings to block legacy Access formats (.mdb/.accdb) that are not required for business use, keep Protected View enabled for files from the internet and email attachments, and use Microsoft Defender for Office 365's Safe Attachments to detonate incoming documents; the trade-off is that legitimate Access databases from external sources will be blocked or sandboxed until they are explicitly trusted. Attack surface reduction rules that block Office applications from creating child processes and from creating executable content will interrupt common post-exploitation behavior but will not prevent the initial heap corruption, and running users without administrative rights limits the blast radius of successful code execution to that user's context at the cost of restricting some legitimate administrative workflows. Detection should focus on Access processes spawning unexpected child processes or making anomalous network connections after a document is opened.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, a heap-based buffer overflow, meaning a length or bounds calculation performed while parsing an Access database file (.accdb/.mdb family) allows attacker-controlled data to be written past the end of a heap-allocated buffer. Because Access is a document-processing application, the overflow occurs in the context of the user who opens the file, and the classic consequence of a heap overflow with adjacent control data is memory corruption that can be steered into arbitrary code execution under that user's privileges. The assessed vector AV:N/AC:L/PR:N/UI:R/S:U is the signature of a malicious-document attack rather than a server-side wormable flaw: the network vector describes file delivery (email attachment, web download, or file share), the user interaction requirement reflects the need for the victim to open the file, and the unchanged scope reflects that exploitation does not cross a privilege or security boundary on its own. No CPE strings were supplied in the source data, so the precise affected Access/Office build range should be taken from Microsoft's advisory rather than inferred.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing RCE: network-deliverable (AV:N) and low-complexity (AC:L) with no auth (PR:N) but requires the victim to open the file (UI:R), yielding full C/I/A in user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Office Access contains a high-severity remote code execution vulnerability (CVE-2026-105596, CVSS 8.8) that triggers when a user opens a specially crafted Access database file, allowing an attacker to execute code with that user's privileges. No vendor patch is currently available, so any employee who routinely opens Access files - particularly finance, operations, and data analytics staff - is a viable social-engineering target, and the attack requires only that someone double-click an attachment. Leadership should treat this as a time-boxed exposure requiring immediate delivery-layer and configuration controls rather than a routine patching item.
No vendor-released patch identified at time of analysis. Interim mitigations: block and quarantine Access file extensions at the email gateway and web proxy; enforce Office Protected View and Access Trust Center policies through Group Policy; uninstall Access from users who do not require it; disable ActiveX and VBA macros where not business-justified; apply application allowlisting or Windows Defender Application Control; and monitor for Office processes spawning script interpreters. Note: the vulnerability is unauthenticated per the CVSS vector (PR:N) but requires user interaction (UI:R) to succeed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB