EUVD-2026-99058
GHSA-crcv-4x3p-wqwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Access database file
-
DeliveryDeliver via email or web to victim
-
ExploitVictim opens file in MS Access
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied, specially crafted Microsoft Access database file in Microsoft Office Access (UI:R in the CVSS vector), so Access must be installed and the user must act on the malicious file. No authentication is required per PR:N - the attacker needs no prior credentials or account. The primary limiting factors are the mandatory user interaction (opening the file, typically via phishing or a malicious download) and the requirement that the target actually has Microsoft Office Access installed and in use; there is no indication of a non-default configuration prerequisite. |
| Impact | This is a legitimately high-priority vulnerability, though not a drop-everything emergency absent exploitation signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution with full confidentiality/integrity/availability impact, gated only by user interaction (UI:R) - the classic 'open a malicious file' pattern for an Office application. No EPSS score, CISA KEV listing, SSVC decision data, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified; the single reference is the Microsoft MSRC advisory. There is no conflict between the CVSS vector and the description - both point to remote, user-interaction-dependent RCE - but the absence of EPSS/KEV/POC means the real-world exploitation signal is currently unknown rather than low. Treat as a serious patch priority given the high impact and low attack complexity against a Microsoft Office component, while recognizing the UI:R requirement meaningfully reduces mass-exploitation potential compared to a zero-click flaw. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Microsoft Access database file to a target. When the victim opens the file, a heap-based buffer overflow (CWE-122) is triggered in Access's parsing code, allowing the attacker to execute arbitrary code in the context of the user. No public exploit code was identified in the provided data, and exploitation requires the victim to open the malicious file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a victim opens a specially crafted Access database file, with an attacker needing no credentials but depending on user interaction to trigger the flaw. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning successful exploitation yields full loss of confidentiality, integrity, and availability within the Access process context, though the mandatory opening of the malicious file limits automated, hands-off exploitation. Based on available intelligence, no public exploit identified at time of analysis and EPSS scoring was not supplied; the entry appears only in the Microsoft Security Response Center update guide, and no CISA KEV listing or other exploitation signal is present.
RemediationAI
No vendor-released patch identified at time of analysis from the provided intelligence; the sole reference supplied is the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105598, which should be checked directly for the current patch status, affected build matrix, and any fixed version once published, and Microsoft Office/Microsoft 365 updates should be applied as soon as a fixed build is offered. In the interim, the most effective compensating controls target the delivery path and the parsing action: block or quarantine Access file types (.accdb, .accde, .accdr, .mdb, .mde, .adp, .ade) at email gateways, web proxies, and file-share ingress, accepting the trade-off that legitimate database exchange workflows will be disrupted and will need an out-of-band, allow-listed transfer channel. Ensure Mark-of-the-Web propagation is preserved so files from the internet open in Protected View, and consider enabling Microsoft Defender Application Guard for Office, which opens untrusted documents in a hardware-isolated container and would contain a successful heap corruption, at the cost of reduced functionality and possible user friction with linked data sources. Attack Surface Reduction rules such as blocking Office applications from creating child processes and blocking Win32 API calls from Office macros can hamper post-exploitation activity but will not prevent the initial heap overflow, and forcing Access to run without administrative rights limits the blast radius of code that executes in the user's context. Additional hardening includes removing Access from endpoints where it is not required, disabling or restricting ActiveX and OLE object activation within Office, and training users to treat unsolicited database attachments and downloads as hostile given that user interaction is the sole trigger for this vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a heap-based buffer overflow (CWE-122), a classic memory-safety class in which a memory buffer allocated on the heap is written past its bounds, corrupting adjacent heap metadata or objects and frequently leading to arbitrary code execution under the privileges of the vulnerable process. Microsoft Access relies on the Access Database Engine (ACE, successor to Jet) to parse database files - typically .accdb/.accde or legacy .mdb/.mde containers built on OLE structured storage - and these parsers consume numerous attacker-influenced length, count, and offset fields from within the file. When such a field is trusted without adequate bounds validation during parsing of a table, query, or object structure, a heap allocation can be sized smaller than a subsequent copy or write, producing the out-of-bounds write described here. The CVSS vector confirms the network attack vector (AV:N) because the malicious file is delivered remotely (email, download, or share), low attack complexity (AC:L) because no special conditions beyond file opening are required, no privileges (PR:N) since no account or authentication is needed, and required user interaction (UI:R) because the victim must open the crafted database. Scope is unchanged (S:U), meaning impact is confined to the Access process and its host user context rather than crossing a security boundary such as a sandbox or hypervisor, and the high C/I/A ratings reflect the potential for arbitrary code execution, data manipulation, and process termination. CPE data was not supplied with the intelligence, so exact affected builds cannot be enumerated here beyond the product-level identification of Microsoft Office Access; the only authoritative vendor reference provided is the MSRC update guide entry for CVE-2026-105598.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over network (AV:N) and opened without special configuration (AC:L) by an unauthenticated user (PR:N), but requires the victim to open it (UI:R); code execution yields full C/I/A impact in the user context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Office Access contains a high-severity heap-based buffer overflow (CVE-2026-105598) that enables unauthenticated remote code execution when a user opens a specially crafted Access database file, with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis. This vulnerability affects any organization where users open Access files from external sources, potentially leading to full compromise of the Access process context. Leadership should prioritize mitigating this risk through user awareness and technical controls while awaiting a vendor fix.
No vendor-released patch identified at time of analysis; interim mitigations include blocking Access file attachments at the email gateway, enforcing Microsoft Defender ASR rules to prevent Office child process creation, disabling or restricting Access for non-essential users, and monitoring endpoint telemetry for abnormal Access process activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB