CVE-2026-105598: Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Access Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
What must an attacker do to exploit this vulnerability?
The attacker must cause Microsoft Office Access to process malicious content delivered over the network. No attacker privileges are required, but the user must interact with the malicious content.
Which environments should be prioritized for remediation?
Prioritize systems running Microsoft Office Access or Microsoft 365 Apps for Enterprise, including 32-bit and 64-bit editions of Office LTSC 2021 and Office LTSC 2024. The vulnerability can result in remote code execution with high impact to confidentiality, integrity, and availability.