EUVD-2026-99071
GHSA-5rw2-7jqh-p7rv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Access file via email
-
DeliveryVictim opens crafted database
-
ExploitTrigger heap buffer overflow
-
ExecutionExecute arbitrary code as user
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to open or interact with an attacker-supplied malicious Microsoft Access database/file (UI:R in the CVSS vector) - it is not triggered remotely without user action. No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L), so no special target-side configuration is needed beyond having Microsoft Office Access installed and the user opening the crafted file. The principal limiting factor is the required user interaction (social-engineering/file-delivery step); Protected View or disabling of untrusted-file opening would further impede exploitation. Impact is confined to the privilege level of the user who opens the file (S:U), so a low-privileged user account limits blast radius. |
| Impact | This is a genuine patch priority rather than a high-CVSS-but-low-risk issue, but with an important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug with full confidentiality, integrity and availability impact - classic client-side RCE profile. The single controlling factor keeping this below critical is UI:R: a user must open or interact with a malicious Access database/file, so this is not wormable or auto-exploitable without a victim action. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no POC is referenced, meaning there is no public exploit identified at time of analysis - the risk is latent capability, not observed activity. Signals are internally consistent (network vector aligns with an email/file-delivery RCE requiring user interaction); nothing conflicts. The main missing data is EPSS and any confirmed affected-version/patch list beyond the MSRC advisory link. |
| Exploit ScenarioDerived | An attacker crafts a malicious Microsoft Access database file that triggers the heap-based buffer overflow and emails or otherwise delivers it to a target. When the victim opens the file, the overflow executes attacker-controlled code in the context of the user, yielding full code execution. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Access lets an attacker execute arbitrary code at the privilege level of a user who opens a specially crafted Access database file, scoring CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No credentials or target-side configuration are needed, but the attack chain depends on the victim opening or interacting with the malicious file (UI:R), making file delivery and social engineering the main barrier; Microsoft has published a fix via its update-guide advisory. There is no CISA KEV entry and no public exploit identified at time of analysis, though the high impact across confidentiality, integrity and availability makes prompt patching a genuine priority.
RemediationAI
Apply the Microsoft security update for CVE-2026-105717 as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105717; the supplied data does not include an exact patched build number, so the update-guide page must be consulted for the specific version per Office channel (Click-to-Run, MSI, LTSC) and platform - that is the authoritative fix and should be prioritized given the potential for full code execution in the user's context. Until patched, the most effective compensating control is to keep the required user interaction from succeeding: enforce Protected View for files originating from the internet and for Outlook attachments, leave Mark-of-the-Web and Office File Block settings enabled so untrusted .accdb/.mdb/.mde/.accde files are not opened in the full-trust process, and block those extensions (including inside archives and via URL/link delivery) at mail gateways, web proxies and endpoint controls - the trade-off is that trusted internal database workflows that legitimately distribute Access files will need allow-listed exceptions and may break until re-permitted. Removing or not deploying Access/ACE on users who do not need it eliminates the attack surface entirely but will break dependent line-of-business tools; where it must remain, run it with least privilege so that any successful exploitation is confined to a low-privileged account (S:U in the vector), and consider application allow-listing and EDR rules for Office spawning unusual child processes as detection rather than prevention. Note that Protected View and attachment blocking are deterrence, not fixes, since a user who explicitly enables content on a crafted file can still trigger the overflow.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a heap-based buffer overflow in the code Microsoft Access uses to parse database file structures, triggered when a malformed database container is opened. Microsoft classifies the root cause as CWE-20 (Improper Input Validation), reflecting that crafted file content is accepted without adequate length/format validation before being copied into a fixed-size heap allocation; the described behavior is also characteristic of the memory-safety classes CWE-122/CWE-787, so defenders should treat it as a classic client-side memory corruption issue rather than a logic flaw. The relevant technology is the Office Access database engine (the ACE/Jet parsing path used for .accdb/.mdb-family files), which runs in-process with the Office application and inherits the user's token, so successful corruption yields code execution in that user's context (S:U). The network attack vector (AV:N) reflects remote delivery of the malicious file, not a remotely reachable service; UI:R reflects that the file must be opened. No CPE data was supplied, so the precise affected build list must be taken from the MSRC advisory rather than inferred.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file is delivered over the network (AV:N) and needs no attacker privileges (PR:N) but requires the victim to open it (UI:R), giving user-context full RCE with high C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity heap-based buffer overflow in Microsoft Access (CVE-2026-105717, CVSS 8.8) allows an attacker to run arbitrary code with the victim's privileges when a user simply opens a crafted Access database file. The attack is unauthenticated and requires no special configuration, but depends on a user opening the file, so email, chat, and file-sharing channels are the primary delivery path - anyone in the organization who regularly opens .accdb/.mdb files is exposed. Because Microsoft Access is widely distributed across Office and Microsoft 365 deployments and no vendor-released patch is currently identified, leadership should treat this as a near-term risk requiring delivery-path controls and application hardening while remediation is tracked.
No vendor-released patch identified at time of analysis. Interim mitigations: block Access file extensions (.accdb, .accde, .accdr, .mdb, .mde, etc.) at email gateways, web proxies, and collaboration services; enforce Mark-of-the-Web and Protected View for Office files from untrusted sources; apply Microsoft Defender for Endpoint attack surface reduction rules that block Office applications from creating child processes; use application allowlisting and least privilege to constrain where msaccess.exe can run and with what rights; and monitor the vendor update guide so the Access fix is deployed as soon as it is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB