EUVD-2026-56713
GHSA-vfqg-r77g-r28q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attack vector (file must be opened), no privileges needed on target system, user interaction required to open the crafted file, full impact on the local process.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
AnalysisAI
Stack-based buffer overflow in Microsoft Office Access enables local code execution with high impact across confidentiality, integrity, and availability. Affected products span Microsoft Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - all at version 16.0.x or 19.0.x prior to the patched releases. An attacker who can deliver a malicious Access file and induce a local user to open it can achieve arbitrary code execution in the context of that user. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) identifies the root cause: a memory region on the call stack is overwritten beyond its allocated bounds, enabling an attacker to corrupt the return address or adjacent control data and redirect execution flow. In Microsoft Access, this likely occurs within a file-parsing routine that fails to validate input length before copying data into a fixed-size stack buffer. The CVSS vector (AV:L) confirms the vulnerability is exercised locally - typically via a crafted .accdb or .mdb file processed by the Access runtime. Affected CPEs span the full Office suite delivery channels: perpetual licenses (Access 2016 x86/x64, Office 2019, Office LTSC 2021, Office LTSC 2024) and the subscription channel (Microsoft 365 Apps for Enterprise). The vulnerability was reported through Microsoft's secure@microsoft.com disclosure channel and is tracked additionally as ENISA EUVD-2026-56713.
RemediationAI
The primary fix is to apply the vendor-released patch via standard Microsoft update channels. For Microsoft Access 2016 (32-bit and 64-bit), update to build 16.0.5565.1000 or later. For Microsoft Office LTSC 2024, LTSC 2021, Office 2019, and Microsoft 365 Apps for Enterprise, apply the latest update from https://aka.ms/OfficeSecurityReleases - specific build numbers for these channels are not enumerated in the advisory but are delivered through Microsoft Update and the Office Deployment Tool. The full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64912. As a compensating control where patching is temporarily blocked, organizations can restrict opening of Access database files (.accdb, .mdb) from untrusted sources using Protected View settings in Office Trust Center, or configure Windows Defender Application Guard for Office to sandbox file opens - the trade-off being some reduction in functionality for legitimate external-file workflows. Blocking Access file extensions at email gateways limits the primary delivery vector with minimal operational impact for most environments.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today