CVE-2026-64906: Microsoft Access Buffer Overflow Flaw

CVE-2026-64906 Overview

CVE-2026-64906 is a heap-based buffer overflow vulnerability in Microsoft Office Access. An unauthorized attacker can execute arbitrary code locally when a user opens a crafted Access file. The vulnerability is categorized under [CWE-122] (Heap-based Buffer Overflow) and requires user interaction to trigger.

Microsoft published the vulnerability on 2026-08-11 through its Security Update Guide. Exploitation results in code execution in the context of the current user, enabling further compromise of the host.

Critical Impact
Successful exploitation of CVE-2026-64906 grants an attacker local code execution with the privileges of the user opening the malicious Access document, enabling data theft, persistence, and lateral movement.

Affected Products

Microsoft Office Access

Discovery Timeline

2026-08-11 - CVE-2026-64906 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64906

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office Access. Access allocates a heap buffer to store data parsed from a database or object file, but fails to validate the size of attacker-controlled input against the destination allocation. Writing past the buffer boundary corrupts adjacent heap metadata and application objects.

An attacker who overwrites heap structures such as function pointers, virtual method tables, or object headers can redirect execution flow. This leads to arbitrary code execution within the Access process. The condition maps to [CWE-122] and is triggered from a local attack surface that still requires user interaction.

The EPSS probability is 0.31% at the 23.483 percentile as of 2026-08-13, indicating a low near-term probability of observed exploitation.

Root Cause

The root cause is missing or insufficient bounds checking during parsing of untrusted content within Microsoft Office Access. Length or count values embedded in the input file drive a heap write without being validated against the allocated buffer size. Any field derived from the file that influences write length is a candidate primitive.

Attack Vector

Exploitation requires an attacker to deliver a specially crafted Access file to a target user through phishing, shared drives, or web download. When the user opens the file in Microsoft Office Access, the parser processes the malicious content and triggers the overflow. Because the flaw requires local file processing and user interaction, mass exploitation depends on social engineering.

No verified public proof-of-concept code is available. Technical details are described in prose only; refer to the Microsoft Security Update Guide for CVE-2026-64906 for vendor-supplied information.

Detection Methods for CVE-2026-64906

Indicators of Compromise

Unexpected child processes spawned by MSACCESS.EXE, particularly cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Access application crashes with exception codes indicative of heap corruption (0xC0000374, 0xC0000005) shortly after opening a document.
Inbound Access files (.accdb, .accde, .mdb, .mde) arriving via email or downloaded from untrusted web origins.
Outbound network connections initiated by the Access process to unfamiliar hosts.

Detection Strategies

Monitor process lineage for MSACCESS.EXE spawning scripting or living-off-the-land binaries.
Alert on Access writing executable content (.exe, .dll, .js, .hta) to user-writable paths such as %TEMP% or %APPDATA%.
Enable Windows Defender Exploit Guard Attack Surface Reduction rules targeting Office child process creation.
Inspect email gateways for Access database attachments and quarantine or detonate them in a sandbox.

Monitoring Recommendations

Ingest Sysmon Event IDs 1 (process create), 11 (file create), and 3 (network connect) filtered on the Access image path.
Correlate Office telemetry with EDR alerts to identify document-triggered execution chains.
Track Windows Error Reporting entries referencing MSACCESS.EXE to surface exploitation attempts that fail.

How to Mitigate CVE-2026-64906

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-64906 across all endpoints running Microsoft Office Access.
Block inbound Access file formats (.accdb, .mdb, .accde, .mde) at email gateways where business use does not require them.
Enforce Protected View and Mark-of-the-Web enforcement for Office documents sourced from the internet.
Educate users to avoid opening unsolicited Access files, particularly from external senders.

Patch Information

Microsoft has released a security update addressing CVE-2026-64906. Full details, affected build numbers, and download links are available in the Microsoft Security Update Guide entry for CVE-2026-64906. Deploy the update through standard channels such as Microsoft Update, WSUS, Intune, or Configuration Manager.

Workarounds

Restrict opening of Access files to trusted internal sources using Group Policy and File Block Settings under the Trust Center.
Enable Attack Surface Reduction rule Block all Office applications from creating child processes on managed endpoints.
Run Microsoft Office Access under standard user accounts, never with administrative privileges, to limit post-exploitation impact.

bash

# Enable ASR rule: Block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled