Microsoft Office Access: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in Microsoft Office Access allows an unauthenticated attacker to execute code over a network. Per the research notes, exploitation most likely requires a user to open a crafted Access file, for example one received by email or downloaded. The CVSS score is 8.8 (High). Microsoft's CISA SSVC assessment rates exploitation as none and automatability as no.
Affected
- Microsoft 365 Apps for Enterprise: from 16.0.1, fixed build unknown
- Microsoft Office LTSC 2021: from 16.0.1 to before 16.0.14334.20974
- Microsoft Office LTSC 2024: from 16.0.0 to before 16.0.17932.21056
- Office 2019 and Microsoft 365 Apps for business are listed in the Microsoft release notes; affected range unknown
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.17932.21056
- Microsoft 365 Apps: Unknown.
- Office 2019: Unknown.
Workaround
- No vendor-documented workaround. Patching is the primary fix.
- Until patched, restrict unsolicited Access files (.accdb, .mdb) from email and downloads, keep Protected View enabled, and limit opening files from untrusted sources (general guidance, not vendor-specific).
Exploitation
- No known in-the-wild exploitation at the time of research.
- Not listed in CISA KEV (per a third-party source, to be rechecked).
- No public proof of concept found.
- EPSS about 0.008 in one snapshot (low predicted likelihood).
Our recommendation
- Install the October 2026 Microsoft Office updates on all Microsoft 365 Apps, Office 2019 and Office LTSC systems.
- Verify the fixed build numbers for Microsoft 365 Apps and Office 2019 on the MSRC advisory before rollout.
- Identify which machines run Access and any Access-based business databases.
- Until patched, block or restrict Access files from untrusted sources and keep Protected View enabled.
- Recheck CISA KEV and public exploit sources for changes.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105598 msrc.microsoft.com
- Microsoft 365 Apps security updates (release notes) learn.microsoft.com
- NVD/CNA record CVE-2026-105598 (Vulners) vulners.com
- Affected versions and KEV status (Strix, third-party) www.strix.ai
- EPSS and VulnCheck enrichment (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:22.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.