Microsoft Office Access: Heap-based buffer overflow enables remote code execution
Summary
A heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network, with a CVSS v3.1 base score of 8.8. Exploitation requires user interaction, such as opening a crafted Access file received by email, download or shared drive. Microsoft has released fixes, and no known exploitation or public proof of concept was found at the time of writing.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build not confirmed by Microsoft in the sources reviewed)
- Microsoft Office LTSC 2021: 16.0.1 to below 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.0 to below 16.0.17932.21056
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.17932.21056
- Microsoft 365 Apps: Unknown; the October 2026 Office security update contains the fix. Third-party sources suggest fixed builds such as 16.0.20430.20182 (current channel), which are not verified against Microsoft's advisory.
Workaround
Unknown. No vendor workaround was found. Keep Protected View and file-block policies enabled for Access files from the internet and email.
Exploitation
- No evidence of exploitation in the wild was found.
- A tracker reports that the CVE is not in the CISA KEV catalogue; this was not checked directly.
- EPSS is about 0.008 (low).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept was found.
Our recommendation
- Install the October 2026 Microsoft Office security update on all Microsoft 365 Apps and Office LTSC systems, starting with systems that open Access files.
- Verify the installed build against Microsoft's Security Update Guide before documenting it as fixed.
- Block or quarantine .accdb and .mdb attachments in the mail gateway where business allows.
- Warn users not to open unknown Access files and to keep Protected View enabled.
- Monitor for unexpected Access file execution and Office process activity.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105596 msrc.microsoft.com
- Microsoft 365 Apps security updates (release notes) learn.microsoft.com
- NVD record via vulners.com vulners.com
- Microsoft MSCVE record via vulners.com vulners.com
- VulnCheck/Vulnrichment record via vulners.com vulners.com
- Strix CVE record CVE-2026-105596 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:17.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.