CVE-2026-94506: Microsoft Office Access Information Disclosure Vulnerability
Microsoft Office Access Information Disclosure Vulnerability
Other sources
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker needs to cause a user to interact with malicious content, as indicated by the required user interaction in the severity vector. No attacker privileges are required, and the attack can be delivered over a network.
What is the expected impact if exploitation succeeds?
Successful exploitation can disclose information from the affected system. The supplied severity vector indicates high confidentiality impact, with no integrity or availability impact.
Which Office deployments are identified as affected?
The listed affected products are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and LTSC 2024, in both 32-bit and 64-bit editions where listed.