CVE-2026-64912: MS Office Access Buffer Overflow Flaw

CVE-2026-64912 Overview

CVE-2026-64912 is a stack-based buffer overflow [CWE-121] in Microsoft Office Access. An unauthorized attacker can execute code locally on a target system after convincing a user to open a crafted Access file. The vulnerability affects the confidentiality, integrity, and availability of the compromised host. User interaction is required for exploitation, which aligns with typical Office document attack chains delivered through phishing.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the current user, enabling malware installation, credential theft, and lateral movement staging.

Affected Products

Microsoft Office Access (specific supported versions per the Microsoft Security Update Guide)
Microsoft 365 Apps deployments that include Access
Standalone Office installations bundling Access

Discovery Timeline

2026-08-11 - CVE-2026-64912 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64912

Vulnerability Analysis

The flaw is a stack-based buffer overflow inside Microsoft Office Access. When Access parses a crafted database or object embedded within an Access file, the code writes attacker-controlled data past the bounds of a fixed-size stack buffer. Overwriting adjacent stack memory, including saved return addresses or structured exception handler records, gives the attacker control over program flow.

Exploitation requires local access and user interaction, matching a phishing-delivered document scenario. The attack does not require prior authentication or elevated privileges. Because Access runs in the security context of the invoking user, successful exploitation yields code execution at that user's privilege level, which is often sufficient for follow-on actions such as persistence and credential harvesting.

Root Cause

The root cause is missing or incorrect bounds validation when Access copies untrusted data from a file into a stack buffer. Classified as CWE-121, this class of defect occurs when the length of input is not compared to the destination buffer size before a copy operation. Attackers craft field lengths or structural elements that exceed the expected size to trigger the overflow.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious .accdb, .mdb, or related Access artifact through email, a shared drive, or a web download. Opening the file in Access triggers the vulnerable parsing routine and executes attacker-controlled code. See the Microsoft Security Update Guide for authoritative technical details.

No public proof-of-concept code is available for CVE-2026-64912.
Refer to the Microsoft Security Update Guide for advisory details.

Detection Methods for CVE-2026-64912

Indicators of Compromise

Unexpected child processes spawned by MSACCESS.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Access opening database files from user-writable locations like %TEMP%, %APPDATA%, or browser download directories.
New scheduled tasks, registry Run keys, or WMI subscriptions created shortly after an Access document is opened.
Outbound network connections initiated by MSACCESS.EXE to previously unseen or non-Microsoft infrastructure.

Detection Strategies

Hunt for anomalous parent-child process chains where MSACCESS.EXE is the parent of a scripting or LOLBin process.
Monitor for crashes in MSACCESS.EXE with exception codes consistent with stack corruption, such as 0xC0000409 (stack buffer overrun) or access violations near the stack.
Inspect email gateways and web proxies for Access file types delivered from untrusted external senders.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process create) and Event ID 11 (file create) to capture Office-originated activity.
Forward Microsoft Defender Exploit Guard and Attack Surface Reduction (ASR) telemetry to your SIEM for correlation.
Alert on Access invoking macros, VBA, or ActiveX components after opening files from internet-marked sources (Mark-of-the-Web).

How to Mitigate CVE-2026-64912

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is released for your channel.
Block inbound Access file attachments (.accdb, .mdb, .accde, .mde) at the email gateway unless a business justification exists.
Enforce Protected View and Mark-of-the-Web for all files received from external sources.
Restrict local administrator rights so exploitation runs with the minimum possible privileges.

Patch Information

Microsoft addresses CVE-2026-64912 through its monthly security update channel. Refer to the Microsoft Security Update Guide for the exact KB articles, affected build numbers, and update packages that correspond to your Office or Microsoft 365 Apps servicing channel. Deploy the update to all endpoints running Access, then validate installation through your patch management platform.

Workarounds

Enable Microsoft Defender ASR rule "Block Office applications from creating child processes" to break common post-exploitation chains.
Configure Group Policy to disable macros and ActiveX controls in files from the internet zone.
Uninstall or block execution of Microsoft Access on systems where it is not required for business operations.
Use Windows Defender Application Control (WDAC) or AppLocker to constrain what MSACCESS.EXE can spawn.

bash

# Example: Enable the ASR rule blocking Office child processes (PowerShell, run as admin)
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled