EUVD-2026-99057
GHSA-33qh-cjjj-79m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Access file to victim
-
DeliveryUser opens malicious database
-
ExploitTrigger heap overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host confidentiality and integrity
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-crafted Microsoft Access database file (e.g., .accdb/.mdb), per UI:R in the CVSS vector - this is the specific, limiting precondition. No authentication is needed (PR:N) and attack complexity is low (AC:L), so once a user opens the malicious file, exploitation is reliable, but the dependence on user interaction means delivery (phishing, download, or shared file) and user action are the gating factors that limit widespread, automated exploitation. Code executes with the privileges of the user who opened the file. |
| Impact | This is a credible, actionable priority rather than an inflated high-CVSS score, but exploitation is gated by user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated code-execution flaw - classic for a file-format parsing bug where the 'network' vector means delivery of a malicious document rather than a direct remote service exploit. The decisive mitigating signal is UI:R: a victim must open or interact with a crafted Access file, which is why the score is 8.8 and not 9.8. No EPSS score, KEV listing, POC, or SSVC data was provided in the input, so exploitation probability and automatability cannot be quantified from the supplied sources. The only reference is the Microsoft MSRC advisory; NVD enrichment (shown as 'None') appears incomplete. Net: treat as a high-priority patch for environments running Access, but note that the absence of KEV/EPSS/POC data means active exploitation is unconfirmed and the practical risk hinges on users opening untrusted database files. |
| Exploit ScenarioDerived | An attacker emails or hosts a malicious Microsoft Access database file and lures a user into opening it. When the file is parsed, a heap-based buffer overflow (CWE-122) is triggered, corrupting memory to execute arbitrary code in the context of the user. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Office Access lets unauthenticated remote attackers execute arbitrary code in the context of the user who opens a specially crafted Access database (.accdb/.mdb) file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms that no credentials are required and attack complexity is low, but the mandatory user interaction (UI:R) - typically a phishing attachment, download, or shared file - is the gating factor that prevents automated, widespread exploitation; code runs only with the privileges of the user who opened the file. There is confirmed KEV? no - no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so this is a credible, patchable priority rather than an actively exploited emergency.
RemediationAI
Apply the Microsoft-released fix as soon as it is available per the vendor advisory for CVE-2026-105597 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105597; patch status is patch available per vendor advisory, and the exact fixed build number should be taken from that MSRC entry rather than assumed. Until patched, reduce the attack surface by blocking .accdb, .mdb, and related legacy Access file types (.accde, .accdr, .adp) at mail gateways, web proxies, and file-share filters, since delivering the crafted file to a user is the required precondition for exploitation. Enforce Office Trust Center Protected View and File Block settings for Access file types, and enable the relevant Attack Surface Reduction rules (block Office applications from creating child processes, and block Win32 API calls from Office macros) so a heap overflow is less likely to chain into a full userland payload; note that these are compensating controls only and will disrupt legitimate workflows that depend on those file types or on macros spawning processes. Where Access or the Access Database Engine is not genuinely needed on a workstation or server, uninstall or unregister the ACE provider to remove the vulnerable parser entirely - an effective but disruptive control that will also break any line-of-business application relying on the Access driver. Because exploitation requires user interaction and executes with the victim's privileges, user awareness training against opening Access databases from untrusted sources complements, but does not replace, prompt patching through Microsoft Update or the Microsoft 365 Apps update channel.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a heap-based buffer overflow (CWE-122) in the parser Microsoft Office Access uses to consume database container files such as .accdb and .mdb, a code path implemented by the Access Database Engine (ACE, formerly Jet). When reading variable-length records and index structures, attacker-controlled length, count, or offset fields are trusted without adequate bounds validation, so a heap allocation can be overrun with excess bytes. Overflowing a heap chunk typically corrupts adjacent heap metadata and neighboring objects, which a skilled attacker can shape into controlled writes and ultimately steer execution flow; under modern OS mitigations this class of bug can still yield reliable code execution in the security context of the process that loaded the file, i.e., the user's Access session. No CPE strings were included in the supplied data, so the exact affected Office builds, update channels, and 32-bit versus 64-bit editions must be confirmed from the vendor advisory rather than inferred here. The Microsoft Security Response Center (secure@microsoft.com) is credited as the reporter and the linked MSRC Update Guide entry is the authoritative technical and version reference.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-delivery parsing bug: AV:N and AC:L for reliable triggering, PR:N as no auth is needed, UI:R because the victim must open a crafted file, with full C/I/A impact in user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Office Access contains a heap-based buffer overflow that could let an attacker execute malicious code on a user's workstation when a crafted Access database file is opened. The attack requires a user to open a phishing attachment or shared file, so the immediate risk is targeted rather than widespread, but a successful exploit would grant the attacker the same access rights as the affected user and could expose sensitive data or business systems. Leadership should prioritize this for remediation planning because no vendor patch is currently available and interim controls are needed to reduce exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: block .accdb and .mdb attachments at email/web gateways; enforce Protected View and Mark of the Web; disable or restrict Microsoft Access via AppLocker/WDAC for non-essential users; monitor EDR for suspicious child processes from MSACCESS.EXE; apply Microsoft workarounds when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB