Microsoft Office Access EUVD-2026-99052

Exploitation requires the victim to open an attacker-supplied, maliciously crafted Microsoft Office Access file (e.g., a database delivered by email or download); this is the UI:R user-interaction requirement in the CVSS vector and is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and attack complexity is low (AC:L), so once a user opens the file against a vulnerable Access version, code executes in that user's context with no further conditions. Limiting factors: the attack is not zero-click (it cannot fire without the user opening the file), impact is bounded to the user's privilege level (S:U, no privilege escalation implied), and a system without the Access component installed is not affected.

This is a genuine high-priority vulnerability, though not a drop-everything emergency absent exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-deliverable, unauthenticated, low-complexity remote code execution with full confidentiality, integrity, and availability impact - the only brake is UI:R, meaning a victim must open a crafted Access file. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified from the data; status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (a classic heap overflow in a file-parsing Office component maps cleanly to AV:N + UI:R), so no CVSS-vs-description conflict exists. The practical risk is driven by Microsoft Office's enormous install base combined with the low technical bar once a user is lured into opening a document - Office file-format RCEs of this class are historically attractive to phishing and commodity-malware operators even before public POCs appear. Key missing data: no EPSS, no KEV, no POC confirmation, and no vendor-specified affected build list beyond the MSRC reference, so prioritization should assume patch urgency typical of a wormable-adjacent Office RCE while acknowledging exploitation has not been confirmed.

An attacker emails or otherwise delivers a maliciously crafted Microsoft Access database file to a target and uses social engineering to get the victim to open it. On open, the file triggers a heap-based buffer overflow in the Access parser, letting the attacker execute arbitrary code in the context of the user. No public exploit code is identified in the provided data, but the low attack complexity makes weaponization straightforward once internals are understood.