CVE-2026-64920: Microsoft Access Buffer Overflow Flaw

CVE-2026-64920 Overview

CVE-2026-64920 is a heap-based buffer overflow vulnerability in Microsoft Office Access. The flaw allows an unauthorized attacker to execute arbitrary code locally on an affected system. Microsoft classifies the issue under CWE-122: Heap-based Buffer Overflow.

Exploitation requires user interaction, typically by opening a crafted Access database file. Successful exploitation grants the attacker code execution in the context of the current user, with full impact to confidentiality, integrity, and availability.

Critical Impact
An attacker who convinces a user to open a malicious Access file can execute arbitrary code, leading to full compromise of the user's session and any data accessible to that account.

Affected Products

Microsoft Office Access (see the Microsoft Security Update Guide for CVE-2026-64920 for exact affected builds)
Microsoft 365 Apps deployments that include the Access component
On-premises Office installations bundling Access

Discovery Timeline

2026-08-11 - CVE-2026-64920 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64920

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office Access. Access parses complex file formats, including .accdb, .mdb, and associated database structures. When parsing malformed input, the affected code writes beyond the bounds of a heap-allocated buffer.

Heap corruption of this class typically overwrites adjacent allocations or memory management metadata. Attackers use this to hijack control flow, redirecting execution to attacker-controlled code. The result is arbitrary code execution in the security context of the user running Access.

Exploitation is local and requires user interaction. An attacker delivers a crafted database file via email, download, or shared storage. When the user opens the file in Access, the parser processes the malicious structure and triggers the overflow.

Root Cause

The root cause is insufficient bounds validation on a heap buffer during file parsing. The affected routine allocates memory based on one field while copying data governed by another, allowing a mismatch that overruns the allocation. Refer to the Microsoft Security Update Guide for vendor technical detail.

Attack Vector

The attack vector is local and requires user interaction. A typical chain is:

Attacker crafts a malicious Access database file containing structures that trigger the overflow.
Attacker delivers the file through phishing, a compromised website, or a shared drive.
The victim opens the file in Microsoft Access.
The parser processes attacker-controlled data, corrupts the heap, and hands control to the attacker's payload.

No verified proof-of-concept code is publicly available for CVE-2026-64920.
See the Microsoft Security Update Guide for vendor-supplied technical detail.

Detection Methods for CVE-2026-64920

Indicators of Compromise

Unexpected child processes spawned by MSACCESS.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or regsvr32.exe.
Access database files (.accdb, .mdb, .accde) delivered from external senders or downloaded from untrusted sources.
Crash events referencing MSACCESS.EXE with heap corruption faults in Windows Error Reporting.
Outbound network connections initiated by MSACCESS.EXE shortly after a database file is opened.

Detection Strategies

Alert on process-lineage anomalies where MSACCESS.EXE launches interpreters, script engines, or LOLBins.
Correlate the opening of Access files with subsequent file writes to %APPDATA%, %TEMP%, or startup locations.
Monitor for suspicious module loads in the Access process, including unsigned DLLs and reflectively loaded code.
Inspect email and web gateways for Access database file types originating from external sources.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized analytics platform for correlation.
Track Windows Error Reporting and application crash events tied to MSACCESS.EXE to surface exploitation attempts.
Maintain an inventory of hosts with Access installed and prioritize telemetry from users who routinely handle external database files.

How to Mitigate CVE-2026-64920

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-64920 as soon as testing allows.
Identify all endpoints with Microsoft Access installed and confirm patch state through configuration management.
Block inbound .accdb, .mdb, and .accde attachments at the email gateway when the business does not require them.
Instruct users not to open Access database files from untrusted or unexpected sources until patches are deployed.

Patch Information

Microsoft has published a security update for CVE-2026-64920. Refer to the Microsoft Security Update Guide for the current list of affected builds, superseded updates, and download links. Deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or your standard patch pipeline.

Workarounds

Enable Protected View and Office Trust Center policies to block macros and active content in files from the internet.
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes.
Restrict Access file types through Group Policy or Microsoft Defender for Office 365 file-blocking policies.
Apply application control (WDAC or AppLocker) to limit which binaries Office processes can spawn.

bash

# Example: enable the ASR rule that blocks Office apps from creating child processes
# Rule GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify the rule state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids