CVE-2026-105595 in 365 Apps for Enterprise
Summary
by MITRE • 10/13/2026
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described constitutes a critical security flaw within the Microsoft Office Access application, specifically involving an out-of-bounds memory read operation. This type of defect is categorized under CWE-125, which refers to Out-of-Bounds Read, indicating that the software attempts to access data beyond the boundaries of allocated memory buffers. In the context of Microsoft Office Access, this flaw typically arises when processing specially crafted database files or objects containing malformed metadata, record structures, or embedded content such as ActiveX controls and macros. The vulnerability allows an attacker who is able to trick a user into opening a malicious file over a network share or via email attachment to trigger the erroneous memory access sequence.
From a technical perspective, out-of-bounds reads often serve as precursors to more severe exploits, including information disclosure or arbitrary code execution. While the immediate effect of reading beyond buffer limits is typically the leakage of sensitive data from adjacent memory regions, such as stack canaries or pointers, it can also lead to undefined behavior that destabilizes the application state. In some scenarios, particularly when combined with other heap corruption techniques or specific exploitation primitives, this initial read violation can be leveraged to achieve arbitrary code execution over a network. This aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution, where attackers exploit vulnerabilities in client software like office suites to gain an initial foothold on the target system without requiring direct user interaction beyond opening the file.
The operational impact of this vulnerability is severe due to its potential for remote code execution. If successfully exploited, it grants unauthorized users full control over the affected system, potentially leading to data theft, installation of malware, or use as a pivot point within an internal network. The attack vector being network-based means that no physical access or local account privileges are strictly necessary if social engineering techniques are employed to deliver the malicious payload. This significantly increases the risk surface for organizations relying on Microsoft Office Access for business-critical data management and reporting tasks.
Mitigation strategies must focus on both technical controls and user awareness. Organizations should immediately apply the latest security patches released by Microsoft, as these updates typically include bounds checking improvements and input validation enhancements to prevent the out-of-bounds access condition. Additionally, implementing application whitelisting can restrict the execution of untrusted scripts or macros within Office applications. Network segmentation should be utilized to limit exposure to potentially malicious files from external sources, and email gateways should be configured to scan for and block suspicious attachments containing embedded objects that might trigger this vulnerability. Regular security training for employees is also essential to reduce the likelihood of successful social engineering attacks aimed at delivering such exploits.