What is the CVSS score of CVE-2026-64906?

CVE-2026-64906 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Access are affected by CVE-2026-64906?

Microsoft Office Access across multiple enterprise versions (Access 2016, Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise) is vulnerable to unauthorized code execution when…. A patch is available.

How to fix or mitigate CVE-2026-64906?

Within 24 hours, inventory all systems running affected Office versions using Active Directory queries and endpoint management tools to establish organizational exposure. Within 7 days, deploy the Microsoft Security Response Center (MSRC) patch to all affected systems, prioritizing high-risk users including those handling external Access files or with administrative privileges. Within 30 days, achieve complete patch coverage across all locations and validate deployment via Windows Update logs or System Center Configuration Manager reporting.

Microsoft Access CVE-2026-64906

EUVD-2026-56710 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-wc6w-j5qq-fqp7

Buffer Overflow Heap Overflow Microsoft 365 Apps Access Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based exploitation requires local delivery and user action (AV:L, UI:R); no system privilege needed (PR:N); full code execution produces C:H/I:H/A:H with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:43 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Access enables local code execution when a user opens a specially crafted Access database file. Affected products span Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad corporate user base. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), a memory corruption class in which a write operation exceeds the bounds of a heap-allocated buffer, potentially overwriting adjacent memory structures and enabling attacker-controlled code execution. Microsoft Office Access is a desktop relational database management application bundled with several Office suites and standalone products. The overflow is triggered during the parsing or processing of a malformed Access database file (.accdb or .mdb), corrupting heap metadata or function pointers in a way that redirects execution flow. Affected products confirmed via EUVD-2026-56710 include Access 2016 (32-bit and standard), Office LTSC 2024, Office LTSC 2021, Office 2019, and Microsoft 365 Apps for Enterprise, all at version 16.x or 19.x baselines. The CVSS vector AV:L reflects that the malicious file must be present on or delivered to the local system before exploitation can occur.

RemediationAI

The primary remediation is to apply Microsoft's released security update via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64906. For Microsoft Access 2016 (both 32-bit and standard editions), upgrade to version 16.0.5565.1000 or later. For Microsoft Office LTSC 2024, LTSC 2021, Office 2019, and Microsoft 365 Apps for Enterprise, apply the latest cumulative update per https://aka.ms/OfficeSecurityReleases - exact patched build numbers for these suites are not independently confirmed beyond the vendor reference. Where immediate patching is not feasible, organizations should consider blocking delivery and execution of Access database file types (.accdb, .mdb) at the email gateway and web proxy layer, with the trade-off that legitimate Access file workflows will be disrupted. Applying Microsoft's Protected View and disabling trusted document settings via Group Policy may reduce the auto-open surface but does not prevent the overflow from being triggered if the user elects to enable editing. Restricting Access application execution on endpoints where it is not required is the most effective compensating control.