Microsoft Access EUVD-2026-99064

Exploitation requires a user to open a malicious, attacker-crafted Microsoft Access file (e.g., a .accdb/.mdb database or embedded object) - the UI:R metric confirms this victim interaction is mandatory, which is the primary limiting factor. No authentication to the target system is needed (PR:N), and attack complexity is low (AC:L), so no special target-side configuration is required beyond having Microsoft Office Access installed and the user opening the file. The practical constraints are: Access must be present on the victim host, the user must be persuaded to open the crafted file (defeating Protected View / Mark-of-the-Web warnings), and code executes only with the opening user's privileges (S:U, no privilege scope change).

This is a credible operational priority but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-delivered, unauthenticated, low-complexity flaw that nonetheless requires user interaction (UI:R) - consistent with the classic Office pattern where a victim must open a malicious .accdb/.mdb file or document delivered via email or web. The heap-based buffer overflow (CWE-122) plausibly yields arbitrary code execution with high confidentiality, integrity, and availability impact in the context of the logged-on user. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from these signals: the status is 'no public exploit identified at time of analysis.' The signals are internally consistent (no CVSS-vs-description conflict), but the high base score is driven largely by impact rather than by frictionless exploitability - the UI:R requirement meaningfully lowers real-world risk versus a true zero-click remote bug. Treat as high-value for patch prioritization on hosts where Access is installed, while recognizing that absence of EPSS/KEV/POC data means active-exploitation risk is currently unknown rather than confirmed low.

An attacker emails or hosts a specially crafted Microsoft Access database or document that, when opened by a victim, triggers a heap-based buffer overflow and executes attacker-controlled code with the user's privileges. Because the flaw requires the target to open the file (UI:R), delivery relies on social engineering such as phishing. No public proof-of-concept or exploit code was identified in the provided data.