Office Access: Out-of-bounds read leads to remote code execution
Summary
Microsoft Office Access contains an out-of-bounds read (CWE-125). According to the CVE record, an unauthorized attacker can execute code over a network, and the CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates that no privileges are needed but user interaction is required. The attack path is not confirmed by the vendor; the most likely scenario, based on the vector, is a user opening a crafted Access file.
Affected
- Microsoft 365 Apps for Enterprise: affected range is 16.0.1 up to a fixed build; the official CNA entry is garbled, so exact builds are unconfirmed
- Microsoft Office LTSC 2021: 16.0.1 to below 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.0 to below 16.0.17932.21056
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.17932.21056
- Microsoft 365 Apps: builds are reported as available in the October 2026 update, but the exact builds are unverified; check the MSRC advisory
Workaround
Unknown. No workaround was found in the sources reviewed; check the MSRC FAQ.
Exploitation
- In the wild: not confirmed; a third-party source lists it as not in the CISA KEV catalogue (not verified directly)
- Public proof of concept: none found
- EPSS: 0.00722 (low)
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Identify endpoints with Microsoft Access installed and record their build numbers
- Install the October 2026 Microsoft 365 or Office update and verify the build afterwards
- Until patched, block .accdb and .mdb files from untrusted senders and keep Protected View enabled
- Re-check the MSRC advisory for exploitation updates and workarounds
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105595 msrc.microsoft.com
- Vulners: Microsoft-sourced entry MS:CVE-2026-105595 vulners.com
- Vulners: NVD entry NVD:CVE-2026-105595 vulners.com
- Strix: CVE-2026-105595 www.strix.ai
- EUVD-2026-99055 vulners.com
- GitHub issue 1849 (third-party KEV status) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:17.
Original description (NVD)
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.