Microsoft Office Access: Heap-based buffer overflow allows code execution
Summary
A heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. Exploitation requires that a user takes an action, such as opening a malicious file or document, and no privileges are needed. The NVD CVSS 3.1 base score is 8.8 (High).
Affected
- Microsoft 365 Apps for Enterprise: affected from 16.0.1, upper bound not confirmed (see MSRC)
- Office LTSC 2021: 16.0.1 to before 16.0.14334.20974 (CVE record)
- Office LTSC 2024: 16.0.0 to before 16.0.17932.21056 (CVE record)
- Other sources list conflicting build numbers. Verify on the MSRC advisory before relying on these numbers.
Fixed in
- Install the October 2026 Office security update for your update channel (release date October 13, 2026).
- Exact fixed build numbers per channel: Unknown. Check the MSRC advisory.
Workaround
- No vendor workaround confirmed. Unknown. Check the MSRC advisory.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV in the sources reviewed. EPSS is about 0.7 percent.
- No public proof of concept or in-the-wild exploitation found in the sources reviewed.
Our recommendation
- Apply the October 2026 Office security update on all clients with Access installed.
- Until patched, keep Protected View and macro restrictions enabled and handle unsolicited Access (.accdb, .mdb) files with caution.
- Check the MSRC advisory for fixed build numbers and recheck CISA KEV.
- Monitor for KEV listing or public exploit code and escalate if either appears.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105597 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- NVD mirror on Vulners: CVE-2026-105597 vulners.com
- Vulners MSCVE entry: MS:CVE-2026-105597 vulners.com
- Vulnrichment entry: CVE-2026-105597 vulners.com
- Strix CVE entry: CVE-2026-105597 www.strix.ai
- CVE configuration data (cve.yack.one) cve.yack.one
- Microsoft Security Release Notes: October 2026 msrc.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:18.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.