What is the CVSS score of CVE-2026-64920?

CVE-2026-64920 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office Access are affected by CVE-2026-64920?

A heap-based buffer overflow in Microsoft Office Access (CVE-2026-64920, CVSS 7.8) allows arbitrary code execution when users open specially crafted database files, potentially affecting all Office…. A patch is available.

Microsoft Office Access CVE-2026-64920

Q: How to fix or mitigate CVE-2026-64920?

Within 24 hours, issue a security alert to all Office users warning against opening database files from untrusted sources, and engage your patch management team to begin prioritizing updates for all affected Office versions. Within 7 days, deploy Microsoft's released patches across Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise via your standard update channels. Within 30 days, complete patch deployment across all systems, verify successful remediation through vulnerability scanning, and conduct user awareness training on the social engineering vectors used to deliver malicious database files.

EUVD-2026-56719 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-vc82-g34w-qxgh

Buffer Overflow Heap Overflow Microsoft 365 Apps Access Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based delivery requires local execution (AV:L); no attacker privileges needed to craft file (PR:N); victim must open it (UI:R); full code execution yields High across all CIA metrics.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:37 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Access enables local code execution across Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise when a victim opens a specially crafted database file. The flaw, rooted in CWE-122, yields full High/High/High impact on confidentiality, integrity, and availability (CVSS 7.8), making successful exploitation equivalent to arbitrary code execution in the user's security context. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches via the Office Security Releases channel.

Technical ContextAI

The vulnerability exists in the Access database parsing engine shared across multiple Microsoft Office suite releases, as confirmed by EUVD-2026-56719 and reported via Microsoft's secure@microsoft.com channel. CWE-122 (Heap-Based Buffer Overflow) identifies the root cause class: during parsing of a malformed Access database file, the engine writes attacker-controlled data beyond the bounds of a heap-allocated buffer. Heap overflows are particularly dangerous in document parsers because heap memory layout is partially influenced by attacker-supplied content, enabling reliable overwrites of adjacent heap metadata, vtable pointers, or function pointers to redirect execution. The flaw spans Access 2016 (builds below 16.0.5565.1000), Office 2019 (19.0.x), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), and Microsoft 365 Apps for Enterprise (16.0.1+), indicating the vulnerable parsing code is present throughout the shared Office codebase rather than isolated to a single product line.

RemediationAI

The primary fix is to apply the vendor-released patch. For Microsoft Access 2016 and Access 2016 (32-bit edition), upgrade to build 16.0.5565.1000 or later. For Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, apply the latest cumulative updates available via https://aka.ms/OfficeSecurityReleases or through Microsoft Update. The MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64920 should be consulted for the authoritative patch mapping. Where immediate patching is not feasible, a compensating control is to block delivery of .accdb, .mdb, and related Access file types at the email gateway and web proxy - this disrupts the primary delivery vector at the cost of preventing legitimate Access file transfers. Additionally, configuring Protected View in Office to open files from the internet or email in read-only sandbox mode can reduce risk, though it does not eliminate it if users dismiss the Protected View prompt.