Microsoft 365 Apps: Remote code execution in Office Access
Summary
A heap-based buffer overflow in Microsoft Office Access allows remote code execution. Per the CVSS vector (CVSS 3.1 8.8), an unauthenticated attacker can run code over the network, but the victim must interact, for example by opening a crafted Access file or link. Microsoft has released a fix; Unknown whether exploitation has occurred.
Affected
- Microsoft 365 Apps for Enterprise (version range in the CVE record is malformed; check MSRC)
- Microsoft Office LTSC 2021: versions 16.0.1 to below 16.0.14334.20974 (per CVE record)
- Microsoft Office LTSC 2024: versions 16.0.0 to below 16.0.17932.21056 (per CVE record)
- Version data from third-party sources is inconsistent and unverified.
Fixed in
- Fix available in Microsoft's Office security release of 13 Oct 2026.
- Build numbers per channel: Unknown; confirm in the MSRC advisory.
- Reference builds from the CVE record: LTSC 2021 16.0.14334.20974 and LTSC 2024 16.0.17932.21056 (to be verified).
Workaround
Unknown. No vendor mitigation text was available; check the MSRC advisory.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No source found reports active exploitation of this CVE.
- EPSS about 0.008 (low).
- No public proof-of-concept known.
- CISA KEV status: to be verified in the current catalogue.
Our recommendation
- Patch all Microsoft 365 Apps and Office LTSC clients through the October 2026 update cycle; prioritise systems with Access.
- Confirm the fixed build for each update channel in the MSRC advisory before rollout.
- Restrict Access files from untrusted sources and warn users not to open unexpected database attachments or links.
- Monitor for KEV changes and vendor updates.
- Verify the CVE identifier in NVD and MSRC, as the six-digit number is unusual.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-105593 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- Vulners NVD entry CVE-2026-105593 vulners.com
- Vulners VulnCheck/Vulnrichment entry vulners.com
- Qualys October 2026 Patch Tuesday review blog.qualys.com
- BleepingComputer October 2026 Patch Tuesday www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:16.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.