EUVD-2026-99025
GHSA-cm8g-f3c2-3wrg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Access file via phishing
-
DeliveryUser opens malicious file
-
ExploitTrigger heap buffer overflow in Access
-
ExecutionExecute arbitrary code as user
-
ImpactEstablish foothold on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open an attacker-supplied, specially crafted Microsoft Access file (UI:R in the vector) - this is the concrete, decisive precondition and the primary limiting factor. The attacker needs no prior authentication or privileges (PR:N) and no special target configuration, but cannot succeed purely remotely without the victim interacting with the malicious file. Realistic risk is therefore bounded by user-interaction controls: email/attachment filtering, Protected View / Mark-of-the-Web blocking of untrusted Office files, and user awareness. Only hosts with Microsoft Access installed and able to open the crafted file type are affected. |
| Impact | This is a credible priority for environments running Microsoft Access, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes network-delivered, unauthenticated, low-complexity code execution that is gated by one thing: UI:R, meaning a user must open a malicious Access file. The HIGH/HIGH/HIGH impact (C:H/I:H/A:H) with S:U reflects full code execution in the context of the user, consistent with a client-side heap overflow (CWE-122). No EPSS score, no CISA KEV listing, and no POC indicator were provided, so there is no evidence of active exploitation or published exploit code - treat this as 'no public exploit identified at time of analysis.' The signals are internally consistent (network file-delivery + required user interaction is the classic Office document vector), with no contradiction between the vector and the description. The main caveat is data sparsity: the only source is the Microsoft MSRC advisory URL, and no affected-version, EPSS, or exploitation-maturity data was supplied, so real-world urgency cannot be refined beyond the base score. Risk is driven by the large installed base of Office and the ease of phishing a user into opening a document, tempered by the UI:R requirement. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted Microsoft Access database/file and lures a user into opening it, triggering a heap-based buffer overflow that runs attacker code with the victim's privileges. No authentication is required of the attacker, but the attack cannot proceed without the user opening the file (UI:R). No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Access is possible when a user opens a specially crafted Access file, exploiting a heap-based buffer overflow (CWE-122) to let an unauthenticated attacker execute code in the context of the victim. Affected are systems with Microsoft Access installed; the attack requires user interaction (UI:R in the CVSS vector) and no public exploit code or confirmed active exploitation is identified at time of analysis, though the vendor advisory should be consulted for updates.
RemediationAI
Apply the update provided by Microsoft per the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102849 as soon as it is available for your Access version; no specific patched version is given in the source data. Until patching is possible, enforce Protected View and Mark-of-the-Web for files from untrusted sources, block Access file extensions (such as .accdb, .accde, .accdr, .accdt, .mdb, .mde, .ade, .adp) at email gateways and web proxies, and consider disabling or restricting Access if not required. Trade-offs: blocking file types may disrupt legitimate business workflows; disabling Access removes functionality. User awareness training to avoid opening unexpected Access attachments also reduces risk, though it is not a technical control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in the way Microsoft Office Access parses a specially crafted file. When a victim opens the malicious file, the overflow occurs in heap memory, potentially allowing arbitrary code execution with the privileges of the user running Access. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the attack is network-delivered but requires user interaction to open the file; no privileges or authentication are needed, and the impact is high to confidentiality, integrity, and availability. The root cause is improper bounds checking during file parsing, a common class of memory-safety flaws in Office document formats. No CPE strings or specific version ranges are provided in the source data; the MSRC update guide is the authoritative source for affected builds.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File is network-delivered (AV:N) with no attacker privileges (PR:N) but requires the victim to open it (UI:R); heap RCE in the user context yields full C/I/A impact with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Access is affected by a high-severity remote code execution vulnerability (CVE-2026-102849) that can execute code in the context of a user who opens a specially crafted Access file. Because the flaw requires user interaction and no vendor-released patch is identified at time of analysis, users who handle Access databases from email, downloads, or shared drives are the primary risk vector, and a successful attack could lead to endpoint compromise, data exposure, and operational disruption. Until Microsoft releases remediation, leadership should treat this as a priority for interim controls, user awareness, and monitoring.
No vendor-released patch identified at time of analysis; interim mitigations include disabling Microsoft Access for users who do not require it, blocking .accdb, .mdb, .accde, and .accdr files from email and web downloads, enforcing Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes, enabling Protected View and Application Guard where applicable, applying least privilege, and monitoring for suspicious Access child processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB