CVE-2026-102849: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-102849 Overview

CVE-2026-102849 is a heap-based buffer overflow vulnerability in Microsoft Office Access that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC on both x86 and x64 architectures. Exploitation requires user interaction, typically opening a crafted Access database file. Successful exploitation grants the attacker code execution in the context of the current user, which can lead to full workstation compromise. The vulnerability is tracked under CWE-122: Heap-based Buffer Overflow.

Critical Impact
An attacker who successfully convinces a user to open a malicious Access file can execute arbitrary code, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2021 LTSC (x86 and x64)
Microsoft Office 2024 LTSC (x86 and x64)

Discovery Timeline

2026-10-13 - CVE-2026-102849 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-102849

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office Access file parsing. When Access processes a specially crafted database file, insufficient bounds checking on a heap-allocated buffer allows attacker-controlled data to overwrite adjacent heap structures. An attacker can leverage this corruption to redirect execution flow and run arbitrary code in the user context.

The attack is network-reachable because the malicious file can be delivered over email, file shares, instant messaging, or hosted on an attacker-controlled website. The user must open the file for exploitation to succeed. Code execution runs under the privileges of the Office process, enabling data theft, lateral movement, or deployment of secondary payloads.

Root Cause

The root cause is improper validation of input length or structure before copying attacker-controlled bytes into a heap buffer within Access. Memory corruption vulnerabilities in Office file formats typically arise from parsing legacy container structures where field sizes are trusted without validation against allocated buffer sizes. The flaw is categorized as CWE-122.

Attack Vector

An attacker crafts a malicious Access database file and delivers it to the target through phishing, a watering-hole site, or a file-sharing platform. When the victim opens the file in a vulnerable version of Access, the parser dereferences attacker-controlled offsets and triggers the overflow. Because no privileges are required on the target and the vulnerability is reachable over the network, this type of file-based delivery pattern is commonly used by initial access brokers and commodity malware operators.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability of exploitation is 0.639%.

See the Microsoft Security Update CVE-2026-102849 advisory for additional vendor technical references.

Detection Methods for CVE-2026-102849

Indicators of Compromise

Unexpected MSACCESS.EXE child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Access database files (.accdb, .mdb, .accde) opened from Outlook attachments, browser downloads, or network shares with abnormal file sizes or malformed headers
Crash events or Windows Error Reporting entries referencing heap corruption in MSACCESS.EXE
Outbound network connections initiated by MSACCESS.EXE to untrusted destinations shortly after a file open

Detection Strategies

Monitor process creation telemetry for Office applications spawning scripting or shell interpreters, which is a reliable signal for Office exploitation chains.
Alert on writes to persistence locations (Run keys, Startup folder, scheduled tasks) by Office processes.
Flag inbound email attachments containing Access file extensions, especially from external senders, and detonate them in a sandbox.

Monitoring Recommendations

Centralize Sysmon or EDR telemetry covering process ancestry, image loads, and network connections for Office binaries.
Correlate Windows Defender Exploit Guard and Attack Surface Reduction rule hits for Office child process creation.
Track user-opened file paths through Office telemetry to identify unusual Access file execution across the fleet.

How to Mitigate CVE-2026-102849

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-102849 to all affected Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC installations.
Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
Block or quarantine inbound Access database file types (.accdb, .mdb, .accde, .mde) at the email gateway unless business-justified.
Enforce Protected View and Mark-of-the-Web for files originating from the internet.

Patch Information

Microsoft has released security updates addressing CVE-2026-102849. Administrators should deploy the fix through Microsoft Update, the Office Click-to-Run update channel for Microsoft 365 Apps, or the standalone update packages for Office 2021 LTSC and Office 2024 LTSC. Verify patch application by checking the Office build number against the version listed in the Microsoft advisory.

Workarounds

Restrict opening of Access files received from external or untrusted sources until patching is complete.
Deploy Group Policy to block macros and ActiveX in files originating from the internet.
Use Windows Defender Application Control or AppLocker to restrict execution of untrusted Access databases.
For users who do not require Access, remove the component from the Office installation to eliminate the attack surface.

bash

# Example: Enable the ASR rule that blocks Office apps from creating child processes
# Rule GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Verify current ASR rule configuration
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids