Microsoft Access EUVD-2026-99054

Exploitation requires the victim to open a maliciously crafted Microsoft Access database/file, as reflected by UI:R in the CVSS vector - there is no zero-click or server-side vector despite AV:N. No authentication is required of the attacker (PR:N) and attack complexity is low (AC:L), but successful code execution depends on the targeted user actually opening the attacker-supplied file, which is the primary limiting factor. Code executes with the privileges of the user who opens the file (S:U, local user context), so a low-privilege victim limits immediate blast radius. The specific affected Microsoft Office/Access versions are not provided in the input and should be confirmed against the MSRC advisory.

This is a serious but not emergency-tier vulnerability. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a client-side remote code execution flaw: network-reachable and low-complexity with no privileges required, but gated by UI:R (user interaction), which is typical of Office document-opening exploits rather than fully wormable server-side attacks. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only reference is the Microsoft MSRC advisory; NVD enrichment is absent (reference source is 'None'). The practical risk is moderate-to-high: a heap overflow (CWE-122) yielding full C/I/A impact in a ubiquitous product is attractive to attackers, but the dependency on a user opening a crafted file meaningfully reduces mass-exploitation potential compared to a zero-click network flaw. Note the UI:R requirement means this is not drive-by remotely exploitable despite AV:N - defenders should treat it as a phishing/social-engineering delivery risk. No signals conflict, but the lack of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the inputs.

An attacker emails or hosts a malicious Microsoft Access database file and lures a victim into opening it. When the file is parsed, a crafted structure triggers a heap-based buffer overflow, letting the attacker execute arbitrary code in the context of the victim user. No public proof-of-concept exploit was identified in the provided data.