CVE-2024-49142: Microsoft Access RCE Vulnerability

CVE-2024-49142 Overview

CVE-2024-49142 is a remote code execution vulnerability in Microsoft Access rooted in a use-after-free condition [CWE-416]. Despite the "remote code execution" label, the attack vector is local and requires user interaction. An attacker crafts a malicious Access database file and convinces a target to open it, at which point arbitrary code executes in the context of the current user. The flaw affects Microsoft 365 Apps, Microsoft Access 2016, Microsoft Office 2019, and the Microsoft Office Long-Term Servicing Channel (LTSC) releases for 2021 and 2024. Microsoft disclosed the issue in the December 2024 Patch Tuesday release.

Critical Impact
Successful exploitation grants code execution with the privileges of the logged-in user, enabling data theft, lateral movement, or deployment of follow-on payloads such as ransomware.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Access 2016
Microsoft Office 2019
Microsoft Office LTSC 2021 and 2024

Discovery Timeline

2024-12-12 - CVE-2024-49142 published to the National Vulnerability Database (NVD)
2024-12-12 - Microsoft released a security update via the Microsoft Security Response Center advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49142

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within Microsoft Access. Use-after-free flaws occur when an application continues to reference memory after that memory has been released, allowing an attacker to control the freed region and influence execution flow. When Microsoft Access parses a crafted database file, it dereferences a dangling pointer, which can lead to arbitrary code execution in the process context.

Microsoft classifies the issue as remote code execution, but exploitation requires local file handling and user interaction. The victim must open a maliciously crafted Access file delivered through email, a shared drive, or a web download. No elevated privileges are required from the attacker prior to exploitation.

Root Cause

The root cause is improper object lifetime management inside Microsoft Access. A component frees an object while another code path retains a reference to it. When the stale reference is later used during file parsing, memory that the attacker has re-allocated with controlled data is treated as a valid object, enabling hijacking of the control flow.

Attack Vector

An attacker crafts a weaponized Microsoft Access database file — commonly .accdb, .mdb, or related formats — and delivers it to a target through phishing or a compromised file share. When the user opens the file in a vulnerable Access build, the parser triggers the use-after-free and executes attacker-supplied code with the user's privileges. No verified public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-49142

Indicators of Compromise

Unexpected child processes spawned by MSACCESS.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Microsoft Access opening database files sourced from email attachments, browser downloads, or the Downloads folder with mark-of-the-web attributes.
Outbound network connections initiated by MSACCESS.EXE to unfamiliar external hosts shortly after a document is opened.
Creation of persistence artifacts (Run keys, scheduled tasks, startup folder entries) following an Access session.

Detection Strategies

Hunt for process-tree anomalies where MSACCESS.EXE is the parent of interpreter or scripting binaries.
Correlate email gateway telemetry for inbound .accdb, .mdb, .accde, and .mde attachments with subsequent endpoint execution events.
Deploy behavioral rules that flag Office applications writing executable content to disk or invoking LOLBins.
Monitor Windows Defender Application Control and AppLocker logs for blocked or anomalous launches originating from Access.

Monitoring Recommendations

Aggregate Microsoft Office telemetry into a centralized data lake for cross-endpoint correlation and long-term retention.
Enable Microsoft Office Attack Surface Reduction (ASR) rule audit logging and alert on triggered rules such as "block Office applications from creating child processes".
Track patch compliance across Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 to identify unpatched endpoints.

How to Mitigate CVE-2024-49142

Immediate Actions Required

Apply the December 2024 Microsoft security update referenced in the MSRC advisory for CVE-2024-49142 to every affected Office installation.
Prioritize patching endpoints used by high-value users such as executives, developers, and administrators who frequently receive external files.
Verify that Microsoft 365 Apps clients are on a supported update channel and have completed the patch rollout.

Patch Information

Microsoft published fixed builds for Microsoft 365 Apps, Microsoft Access 2016, Microsoft Office 2019, and Microsoft Office LTSC 2021 and 2024. Refer to the Microsoft Security Update for CVE-2024-49142 for the exact KB numbers and build versions applicable to each channel.

Workarounds

Block inbound Microsoft Access file formats (.accdb, .mdb, .accde, .mde) at the mail gateway when they are not required by business processes.
Enforce Microsoft Office Protected View and disable macros for files originating from the internet.
Enable Attack Surface Reduction rules that prevent Office applications from creating child processes and from injecting into other processes.
Restrict use of Microsoft Access to users who have a documented business need through application allowlisting.

bash

# Configuration example: enable ASR rules via PowerShell to reduce Office abuse surface
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled