What is the CVSS score of EUVD-2026-56715?

EUVD-2026-56715 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Access are affected by EUVD-2026-56715?

A vulnerability in Microsoft Access and multiple Office product families enables complete system compromise when users open malicious database files, creating a supply-chain risk vector for…. A patch is available.

How to fix or mitigate EUVD-2026-56715?

Within 24 hours: Identify all systems running Microsoft Access 2016 (32- and 64-bit), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise; issue security advisory warning users against opening untrusted Access database files from external sources. Within 7 days: Begin staged patch deployment through your patch management system, prioritizing user-facing systems and departments handling external Access files; validate patches in non-production environments with Access-dependent workflows. Within 30 days: Complete patch deployment across all Office installations, verify remediation through endpoint compliance scanning, and document closure in your vulnerability management system.

Microsoft Access EUVD-2026-56715

| CVE-2026-64908 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-9h6c-7jf3-m5wg

Buffer Overflow Heap Overflow Microsoft 365 Apps Access Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-parse trigger requires user interaction but no privileges; full C/I/A impact reflects arbitrary code execution in victim context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:41 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Access enables local arbitrary code execution with full confidentiality, integrity, and availability impact across several Office product families. The vulnerability, rooted in CWE-122, affects Microsoft Access 2016 (both 32- and 64-bit editions), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires local access and user interaction - consistent with a malicious database file delivery scenario - and a vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Microsoft Access is a relational database management application in the Microsoft Office suite, using the Jet/ACE engine to process .accdb and .mdb file formats. CWE-122 (Heap-based Buffer Overflow) describes a condition where data written to the heap exceeds its allocated buffer boundary, corrupting adjacent heap metadata or function pointers in ways that can redirect execution flow. In Access, this overflow most likely occurs during parsing or rendering of a specially crafted database file or embedded object, corrupting heap structures within the Access process. All affected product lines share the Office 16.x codebase: Access 2016 is patched at build 16.0.5565.1000, while LTSC 2021, LTSC 2024, Office 2019, and Microsoft 365 Apps for Enterprise are addressed through Microsoft's click-to-run servicing at https://aka.ms/OfficeSecurityReleases. The CVSS AV:L/AC:L/PR:N/UI:R vector is consistent with a file-parsing attack surface where no elevated privileges are needed but a victim must interact with a malicious file.

RemediationAI

The primary fix is to apply the vendor-released patch via Microsoft Update or click-to-run servicing. For Microsoft Access 2016, upgrade to build 16.0.5565.1000 or later. For Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, apply the latest cumulative update through the Office servicing channel documented at https://aka.ms/OfficeSecurityReleases. The Microsoft Security Response Center advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64908. Where patching is not immediately possible, a compensating control is to block delivery of .accdb and .mdb file attachments at the email gateway and web proxy, reducing the primary phishing delivery vector; note this does not protect against files delivered via network shares or USB. Disabling Microsoft Access entirely via Group Policy (removing the application feature) is a more aggressive workaround for organizations that do not use Access, with no functional trade-off for those users.