Microsoft Office Access EUVD-2026-99060

Exploitation requires the victim to open a crafted Microsoft Office Access file (UI:R in the CVSS vector), so this is a file-parsing attack dependent on social engineering or file delivery rather than a remote service exposure despite the AV:N 'over a network' label. No authentication or elevated privileges are needed on the target (PR:N), and no special non-default configuration is indicated - any user running an affected version (Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, or Office LTSC 2021 before 16.0.14334.20974) who opens the malicious file is exposed. The required user interaction is the primary limiting factor, and impact is confined to information disclosure (no integrity or availability effect).

This is a moderate-risk information-disclosure flaw, not an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated vector that is gated by required user interaction (UI:R) and yields confidentiality impact only (C:H, I:N, A:N) - consistent with a CWE-125 out-of-bounds read that leaks memory. All exploitation-maturity signals point low and are mutually consistent: not listed in CISA KEV, no public POC identified in the provided data, and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. The SSVC 'Automatable: no' aligns with the UI:R requirement (each victim must be lured into opening a crafted file), which materially caps worm-like or mass-exploitation potential. One point worth verifying: Microsoft labels this AV:N ('over a network') while the real-world mechanism for an Office Access parsing bug is almost always delivery of a malicious database/file that the user opens - the 'network' designation reflects remote delivery rather than a remotely listening service, so defenders should treat this as a file-borne threat. No KEV/POC/EPSS conflict exists because active-exploitation signals are uniformly absent. Net: a vendor-patched, interaction-dependent info leak - schedule it in normal patch cadence rather than emergency response.

An attacker emails or hosts a specially crafted Microsoft Access database/file and socially engineers a user into opening it. When Access parses the malformed structure, the out-of-bounds read discloses adjacent process memory (potentially containing sensitive data), which the attacker can exfiltrate or use to defeat memory-layout protections. No public exploit code is identified at time of analysis, and the low attack complexity means a working trigger is plausible once file internals are understood.