CVE-2026-69477: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-69477 Overview

CVE-2026-69477 is a heap-based buffer overflow [CWE-122] in Microsoft Office Access. An authorized local attacker can execute arbitrary code on the target system by convincing a user to open a crafted Access database file. The flaw affects Microsoft 365 Apps, Microsoft Access 2016, and Office 2019, 2021, and 2024 across x86 and x64 builds.

Exploitation requires local access, low privileges, and user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability within the user context.

Critical Impact
Local code execution in the context of the Office user, enabling attacker persistence, data theft, and lateral pivoting within enterprise Microsoft 365 deployments.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Access 2016 (x86 and x64)
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024

Discovery Timeline

2026-09-08 - CVE-2026-69477 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-69477

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Microsoft Office Access component. Access mishandles the size of an attacker-controlled structure when parsing a database file, writing data past the bounds of a heap-allocated buffer. The overflow corrupts adjacent heap metadata or object pointers within the Access process.

An attacker who controls the corrupted memory can steer execution flow to attacker-supplied shellcode or reused code gadgets. Because Access runs with the invoking user's privileges, the attacker inherits those privileges upon successful exploitation. Microsoft classifies the attack complexity as low, which indicates a reliable exploitation primitive for a prepared attacker.

Root Cause

The root cause is missing or incorrect bounds validation when Access allocates and populates a heap buffer from fields inside a database file. Untrusted length or count values from the file drive a write that exceeds the allocated size. This is a classic heap overflow pattern common in legacy Office file format parsers.

Attack Vector

Exploitation requires a local vector with user interaction. The attacker crafts a malicious .accdb, .mdb, or related Access file and delivers it through email, a shared drive, a collaboration platform, or a download. When a user with an authorized Office session opens the file, Access parses the malformed structure and triggers the overflow. No network-facing service is exposed by this issue.

The vulnerability mechanism is documented in the Microsoft Security Update for CVE-2026-69477. No public proof-of-concept exploit is available at time of writing.

Detection Methods for CVE-2026-69477

Indicators of Compromise

Unexpected child processes spawned from MSACCESS.EXE, particularly cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
Access process crashes with heap corruption exceptions (STATUS_HEAP_CORRUPTION, 0xC0000374) logged in Windows Error Reporting.
Newly created Access database files (.accdb, .mdb, .accde) arriving from external email, chat, or web download sources.
Outbound network connections initiated by MSACCESS.EXE to previously unseen or non-corporate destinations.

Detection Strategies

Hunt for process lineage anomalies where MSACCESS.EXE is the parent of scripting or living-off-the-land binaries.
Correlate Office telemetry with file write events to %APPDATA%, %TEMP%, and Startup folders following the opening of an Access database.
Monitor for suspicious module loads inside MSACCESS.EXE, including unsigned DLLs and modules loaded from user-writable paths.

Monitoring Recommendations

Enable and centralize Microsoft Defender Antimalware Scan Interface (AMSI) and Office telemetry to a SIEM for cross-host correlation.
Alert on Windows Error Reporting entries indicating heap corruption faults in Office binaries.
Track email gateway and web proxy logs for inbound Access database attachments and downloads from untrusted senders.

How to Mitigate CVE-2026-69477

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all affected Office channels.
Inventory endpoints running Microsoft 365 Apps, Access 2016, and Office 2019/2021/2024 to confirm patch deployment coverage.
Block inbound Access database file types (.accdb, .mdb, .accde, .mde) at the email gateway when not required for business operations.
Enforce Microsoft Office Protected View and Attack Surface Reduction (ASR) rules that restrict child process creation from Office applications.

Patch Information

Microsoft published a security update for CVE-2026-69477 through the standard update guide. Refer to the Microsoft Security Update for CVE-2026-69477 for build numbers per channel (Current Channel, Monthly Enterprise, Semi-Annual, and LTSC). Deploy through Microsoft Update, Windows Server Update Services (WSUS), Intune, or Configuration Manager.

Workarounds

Disable or uninstall Microsoft Access on endpoints where it is not required for business function.
Configure Office File Block policy through Group Policy to prevent opening legacy Access file formats from untrusted locations.
Use Windows Defender Application Control or AppLocker to restrict execution of child processes spawned by MSACCESS.EXE.
Deliver user awareness guidance instructing staff not to open unsolicited Access database attachments.

bash

# Example ASR rule GUID to block Office apps from creating child processes
# Rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled