Description

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:51.870Z",
  "pubdate": "2026-08-11T17:18:51.870Z",
  "executiveSummary": "This vulnerability is a heap-based buffer overflow affecting Microsoft Office Access. The flaw enables an unauthorized local attacker to execute arbitrary code within the context of the current user.\nThe risk implication is severe, as successful exploitation could lead to full system compromise or unauthorized data access depending on the privileges of the user running the affected application.\nThe attack capabilities require local access to the target system where the vulnerable Microsoft Office Access component is installed and executed.\nNo specific preconditions beyond local execution and user interaction to open a malformed file or trigger the vulnerable code path are explicitly detailed in the baseline description.",
  "technicalDetails": "The vulnerability resides in the heap memory management routines of Microsoft Office Access when processing specific data structures.\nThe root cause stems from improper bounds checking during memory allocation and data copying operations within the heap-based buffer, leading to a heap-based buffer overflow condition.\nExploitation occurs when an unauthorized local attacker supplies a specially crafted input or file processed by Microsoft Office Access, causing memory corruption on the heap.\nThe attack flow involves the vulnerable component allocating an insufficient amount of heap memory for the incoming data structure.\nSubsequent copy operations write past the allocated boundary of the heap chunk, overwriting adjacent heap metadata or critical application data structures.\nBy carefully controlling the size and content of the overflow data, an attacker can manipulate heap structures to achieve arbitrary code execution.\nThe affected component is Microsoft Office Access, requiring local access and no initial authentication to trigger the vulnerable parsing routines.\nPrivilege requirements are limited to standard local user privileges capable of executing the application or opening the malicious file.\nNetwork exposure is not a direct vector based on the local execution constraint.\nPost-exploitation impact includes arbitrary code execution, potential escalation of local privileges, and compromise of user data managed by Microsoft Office Access."
}