EUVD-2026-48452
GHSA-w7fc-p5p7-c9pf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states network RCE by an unauthorized attacker with no interaction, so AV:N/PR:N/UI:N/AC:L; heap-overflow code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Account arises from a heap-based buffer overflow that an unauthorized, network-based attacker can trigger without authentication or user interaction, per the CVSS:3.1 vector (AV:N/PR:N/UI:N). The CVSS temporal data indicates exploit maturity is Unproven (E:U), so no public exploit identified at time of analysis and the issue is not on CISA KEV; however, an official vendor fix (RL:O) with Confirmed report confidence (RC:C) is already available. Given the 9.8 base score and full confidentiality/integrity/availability impact, this warrants priority remediation despite the current absence of exploit code.
Technical ContextAI
Microsoft Account is Microsoft's consumer identity and authentication service (the identity backbone for Windows sign-in, Outlook.com, Office, OneDrive, Xbox, and related consumer cloud services), represented here by cpe:2.3:a:microsoft:microsoft_account:*:*:*:*:*:*:*:*. The root cause is CWE-122 (Heap-Based Buffer Overflow): the code allocates a buffer on the heap and then writes past its bounds, corrupting adjacent heap metadata or objects. Attacker-controlled data sizing or content in a network-reachable parsing path lets the overflow overwrite control structures, which is the classic primitive that leads to arbitrary code execution. Because the affected component is an authentication surface reachable over the network, the overflow can be reached pre-authentication.
RemediationAI
Patch available per vendor advisory: apply the update referenced in Microsoft's MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165 as the primary fix; the CVSS RL:O (Official Fix) metric confirms a vendor remediation exists, though an exact fixed version string was not included in the source data and should be read directly from the MSRC page. Because Microsoft Account patching for cloud-backed components is often delivered automatically, verify that Windows Update / automatic servicing is enabled and that endpoints have checked in successfully rather than assuming coverage. As interim compensating controls where patch deployment lags, restrict and monitor network exposure of the authentication surface (limit inbound reachability to trusted networks and inspect for anomalous or oversized authentication traffic that could indicate overflow attempts); note the trade-off that tightening network access to identity endpoints can disrupt legitimate sign-in flows, so validate in a pilot ring first.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today