CVE-2026-105595: Microsoft 365 Apps RCE Vulnerability

CVE-2026-105595 Overview

CVE-2026-105595 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Access that enables remote code execution. An unauthenticated attacker can exploit the flaw over a network by convincing a user to open a crafted file. The vulnerability affects Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC across x86 and x64 editions. Microsoft published the advisory on October 13, 2026, and the issue carries a CVSS 3.1 base score of 8.8.

Critical Impact

Successful exploitation grants attackers full code execution in the context of the current user, enabling data theft, lateral movement, and installation of additional payloads.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft Office 2021 LTSC (x86 and x64)
• Microsoft Office 2024 LTSC (x86 and x64)

Discovery Timeline

• 2026-10-13 - CVE-2026-105595 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-105595

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Access file parsing. When Access processes a specially crafted database file, the parser reads memory outside the bounds of an allocated buffer. Attackers leverage this condition to leak memory contents and corrupt program state, enabling arbitrary code execution in the context of the logged-on user. The EPSS probability is 0.738%, indicating a measurable likelihood of exploitation attempts over the near term.

Root Cause

The underlying weakness stems from missing or improper bounds validation in the routine that parses structured Access data. Specifically, length fields or offsets within the file are trusted without verification, causing the parser to dereference memory past the end of an input buffer. Attackers craft these fields to redirect reads into controlled memory regions and bypass runtime defenses.

Attack Vector

Exploitation requires user interaction. An attacker delivers a malicious Access file through email, a hosted web link, or a compromised document repository. When the target opens the file, Access parses the malformed structures and triggers the out-of-bounds read. Chained with memory corruption primitives, this results in code execution with the user's privileges. No prior authentication to the victim system is required.

For technical details, refer to the Microsoft CVE-2026-105595 Update Guide.

Detection Methods for CVE-2026-105595

Indicators of Compromise

• Unexpected MSACCESS.EXE child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Access database files (.accdb, .mdb, .accde) arriving from external sources or opened from temporary internet locations.
• Outbound network connections initiated by MSACCESS.EXE to uncategorized or newly registered domains.
• Office processes writing executable content to user-writable directories such as %APPDATA% or %TEMP%.

Detection Strategies

• Hunt for process-tree anomalies where MSACCESS.EXE spawns scripting hosts or living-off-the-land binaries.
• Alert on Access reading files from mail attachments or browser download paths followed by shell execution.
• Correlate Microsoft Defender SmartScreen and Mark-of-the-Web events with subsequent child process creation under Office binaries.

Monitoring Recommendations

• Enable command-line and module-load logging for Office processes and forward events to a centralized analytics platform.
• Monitor file-write telemetry for Access-created artifacts in persistence locations such as Run keys and Startup folders.
• Track Office telemetry for crash events in MSACCESS.EXE, which can precede or indicate exploitation attempts.

How to Mitigate CVE-2026-105595

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory to all affected Office installations.
• Prioritize patching endpoints where users routinely open Access files from external senders.
• Verify Click-to-Run and Microsoft 365 Apps update channels are current and that pending restarts have been completed.

Patch Information

Microsoft released fixes through the October 2026 security update cycle for Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC. Administrators should consult the Microsoft CVE-2026-105595 Update Guide for build numbers and deployment guidance specific to each channel.

Workarounds

• Block inbound .accdb, .mdb, and .accde attachments at the email gateway until patches are deployed.
• Enforce Protected View and Mark-of-the-Web for files originating from the internet.
• Use Attack Surface Reduction rules to prevent Office applications from creating child processes.
• Restrict Access execution through AppLocker or Windows Defender Application Control where business requirements permit.

# Enable the ASR rule blocking Office child processes (PowerShell, elevated)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled