Microsoft Office Access: Remote code execution via heap-based buffer overflow
Summary
Microsoft Office Access contains a heap-based buffer overflow (CWE-122) that allows remote code execution. An unauthorized attacker can execute code on a victim's system if the user interacts with crafted content, such as opening a file. Microsoft rates the CVSS base score at 8.8. Microsoft has released security updates, and no exploitation has been reported.
Affected
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit): exact fixed build per channel unconfirmed, check MSRC
- Microsoft Office LTSC 2021 (32-bit and 64-bit): versions 16.0.1 to before 16.0.14334.20974
- Microsoft Office LTSC 2024 (32-bit and 64-bit): versions 16.0.0 to before 16.0.17932.21056
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.20974 or later
- Microsoft Office LTSC 2024: 16.0.17932.21056 or later
- Microsoft 365 Apps for Enterprise: fixed build not confirmed in the sources; check the MSRC update guide for the build per channel
Workaround
Unknown. Microsoft has not published a workaround; the update is the fix.
Exploitation
- Microsoft's CVSS temporal vector states exploit code maturity 'Unproven'.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV at the time of the sources.
- No public proof-of-concept or exploitation reports found.
Our recommendation
- Install the October 2026 Microsoft security updates for Microsoft 365 Apps and Office LTSC 2021/2024 as a priority, especially where Access is installed.
- Verify the installed build against the MSRC update guide before and after rollout.
- Restrict opening untrusted Office files from email and file sharing until patched.
- Monitor CISA KEV and Microsoft updates for signs of exploitation.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory msrc.microsoft.com
- Microsoft Office security release notes learn.microsoft.com
- Vulners MSCVE mirror vulners.com
- VulDB vuldb.com
- GitHub vulnerability alert github.com
- Qualys Patch Tuesday review, October 2026 threatprotect.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:31.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.