Microsoft Access EUVD-2026-99062

Exploitation requires a victim to open an attacker-crafted Microsoft Access database file (UI:R in the vector), making targeted social engineering or phishing the realistic delivery path; it is NOT a server-side remotely-reachable condition despite the AV:N label, which reflects network file delivery rather than an exposed listening service. The high attack complexity (AC:H) further limits reliability, implying the overflow depends on specific heap state or crafted file structures. No authentication is needed on the attacker side (PR:N), and code executes with the opening user's privileges, so impact is bounded by that user's rights rather than system/admin level.

This is a moderate-priority issue that scores CVSS 7.5 (High) rather than Critical precisely because exploitation is non-trivial: the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R shows high attack complexity (AC:H) and required user interaction (UI:R), which materially offset the network vector (AV:N) and lack of required privileges (PR:N). The AV:N designation reflects Microsoft's convention for file-delivery-over-network (e.g., a malicious .accdb/.mdb mailed or hosted) rather than a server-side remotely reachable listener - real-world exploitation still hinges on convincing a user to open a crafted Access database, so this behaves operationally much like a client-side/local-file bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent mass exploitation; the full impact triad (C:H/I:H/A:H) means successful exploitation yields code execution with the victim's privileges, which is serious but gated by the AC:H + UI:R preconditions. Net: patch in a normal cycle and prioritize for users who routinely open externally-sourced Access files, but this is not a drop-everything internet-facing emergency.

An attacker crafts a malicious Microsoft Access database file that triggers a heap-based buffer overflow (CWE-122) and emails or hosts it; when a targeted user opens the file, memory corruption leads to arbitrary code execution in the user's security context. No public exploit code was identified at time of analysis, and the high attack complexity suggests reliable exploitation requires non-trivial engineering.