EUVD-2026-56721
GHSA-9xfr-gghp-vfm7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector with mandatory user file-open interaction; no attacker privileges needed as any user account can open an Access file, yielding full C/I/A impact upon exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
AnalysisAI
Stack-based buffer overflow in Microsoft Office Access enables a local unauthenticated attacker to achieve arbitrary code execution when a victim opens a specially crafted Access database file. Affected products span Microsoft Access 2016 (32-bit and 64-bit), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and a vendor-released patch is available through the Microsoft Security Response Center.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) identifies the root cause as improper bounds checking during Access file parsing, where attacker-controlled data - such as oversized field values, record metadata, or embedded object headers in .accdb or .mdb formats - overflows a fixed-size stack buffer, corrupting the return address or adjacent control data. This class of vulnerability in Office document parsers typically targets legacy binary format handling routines that lack modern mitigations such as stack canaries or safe string APIs. Affected CPE strings span both 32-bit and 64-bit builds of Access 2016 (16.0.x) through the current Microsoft 365 Apps for Enterprise channel, indicating the vulnerable parsing code is shared across the product family.
RemediationAI
Apply the vendor-released patch via Windows Update or the Microsoft Update Catalog as directed by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64919. For Microsoft Access 2016 (32-bit and 64-bit), update to version 16.0.5565.1000 or later - this is the only version for which an exact fixed build is confirmed. For Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, apply the latest cumulative updates per https://aka.ms/OfficeSecurityReleases, as exact fixed build numbers were not independently listed for those channels. As interim compensating controls where patching is delayed, configure Microsoft Office Protected View to prevent automatic execution of content from Access files received from the internet or email; this imposes a user confirmation step but does not fully block local file opening. Enabling Microsoft Defender Attack Surface Reduction rule 'Block Office applications from creating executable content' can further constrain post-exploitation behavior. Restricting Access file type associations (.accdb, .mdb) system-wide via Group Policy will prevent accidental opening but may disrupt legitimate database workflows.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today