Microsoft Office Access EUVD-2026-99026

Exploitation requires a victim to open an attacker-crafted Microsoft Access file (UI:R in the CVSS vector), so it depends on user interaction and a working social-engineering delivery (email attachment, download, or shared file). The Microsoft Access component of Office must be installed and used to open the file; environments without Access deployed are not exposed. No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L), but the user-interaction gate means this is not remotely triggerable against an idle system and is not self-propagating. Code executes in the context/privileges of the user who opens the file, not automatically as SYSTEM.

This is a credible mid-to-high priority issue, but not a drop-everything emergency based on current signals. The CVSS 3.1 base score is 8.8 (High) with an AV:N/AC:L/PR:N/UI:R vector: network attack vector, low complexity, no privileges required, but user interaction IS required - the classic Microsoft Office pattern where a victim must open a maliciously crafted Access database/file. Impact is severe (C:H/I:H/A:H, Scope:Unchanged), consistent with arbitrary code execution in the user's security context. No EPSS probability score was provided in the input, so exploitation likelihood cannot be quantified. KEV status is not indicated (not listed), and no proof-of-concept is referenced, so this is best treated as no public exploit identified at time of analysis rather than active exploitation. No SSVC decision data was supplied. The key tension to flag: the headline '8.8 network RCE' reads more dangerous than the practical reality, because UI:R means exploitation hinges on social engineering (getting a target to open a hostile file) - it is not wormable or self-propagating. There is no conflict between the CVSS vector and the description; both agree on network-delivered, user-interaction-gated code execution. Missing data: EPSS score and any vendor exploitability assessment from Microsoft's MSRC advisory were not included in the provided input and should be verified directly.

An attacker emails or hosts a malicious Microsoft Access database file and lures a victim into opening it. When the file is parsed, a heap-based buffer overflow (CWE-122) is triggered, corrupting heap memory to achieve arbitrary code execution in the context of the user who opened the file. No public proof-of-concept was referenced in the provided data, and the required user interaction (UI:R) makes this dependent on successful social engineering.