Microsoft Office Access: Heap-based buffer overflow enabling remote code execution
Summary
A heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. Access is a client application, so an attacker needs to deliver a crafted file or link that a user opens (user interaction) and the attack complexity is high. No login is required once a user is reached, so email and download filtering are important.
Affected
- Microsoft 365 Apps for enterprise (exact affected builds: see the MSRC advisory)
- Office LTSC 2021: before 16.0.14334.20974 (third-party data, not yet verified with Microsoft)
- Office LTSC 2024: before 16.0.17932.21056 (third-party data, not yet verified with Microsoft)
- Microsoft 365 Apps for business, Office 2019, Office 2021 and Office 2024 are listed in Microsoft's October 2026 release notes for this CVE; version details unknown.
Fixed in
- Fixed in the Microsoft security updates of October 13, 2026.
- Exact fixed build numbers: see the MSRC advisory. Do not rely on third-party build lists.
Workaround
Unknown. No vendor workaround found; the security update is the fix.
- Interim measures (not from the vendor): block or quarantine Access database files (.accdb, .mdb) from external senders and do not open them from untrusted sources.
Exploitation
- CISA KEV: not listed at the time of research; confirm against the CISA catalogue.
- No public proof-of-concept found (this means nothing was found, not that none exists).
- EPSS 0.00548 (low).
- No known exploitation in the wild.
Our recommendation
- Install the October 13, 2026 Microsoft Office security updates on all systems with Microsoft 365 Apps, Office LTSC 2021 or LTSC 2024, and verify the build numbers against the MSRC advisory.
- Prioritise systems that use Access and receive external files.
- Check whether Access is installed at all and remove it where it is not needed.
- Patch the whole batch of Access CVEs together (including CVE-2026-105716 and CVE-2026-105717, which are rated higher).
- Filter email attachments and downloads, and monitor for unusual Office activity.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-105714 msrc.microsoft.com
- Microsoft 365 Apps security update release notes learn.microsoft.com
- CNA record via Vulners vulners.com
- MSCVE data via Vulners (version ranges) vulners.com
- Rapid7 data via Vulners (EPSS, CWE) vulners.com
- NVD mirror via Vulners vulners.com
- Strix CVE page (third-party, possibly stale) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:34.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.