← All CVEs

CVE-2026-64906

HIGH 7.8 ALL-YEARS

Published 2026-08-11 · Last modified 2026-10-21 · microsoft · NVD: Analyzed

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.

ELEVATED IMPACT

Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 40th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

7.8CVSS 3.1 · HIGH · CNA

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
⚠User interaction: A user must take an action (click / open a file)
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Microsoft

Products Microsoft 365 Apps For Enterprise Microsoft Access 2016 Microsoft Access 2016 (32 Bit Edition) Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 365 Apps Access Office 2019 Office 2021 Office 2024

Weakness (CWE)

CWE-122: : Heap-based Buffer Overflow

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References and research data (JSON)

Known Affected Software Configurations

Vendor	Product	Version range
Microsoft	365 Apps	*
Microsoft	365 Apps	*
Microsoft	Access	2016
Microsoft	Access	2016
Microsoft	Office 2019	*
Microsoft	Office 2019	*
Microsoft	Office 2021	*
Microsoft	Office 2021	*
Microsoft	Office 2024	*
Microsoft	Office 2024	*

All CVSS metrics

HIGH 7.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Patches & mitigations

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64906 vendor-advisorypatchVendor AdvisoryCVE record · microsoft · Updated 2026-10-21T20:54:16.361Z
NVD · CVE-2026-64906 · Updated 2026-10-14T22:10:00.210

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56710 ADVISORYEUVD · EUVD-2026-56710

Sources: NVD · CVE.org · All sources and attribution · EPSS