A relative path traversal flaw in Microsoft Office Access enables an unauthorized attacker to execute arbitrary code on the local machine. The vulnerability arises when Access processes file paths that are not fully validated, allowing crafted paths to access sensitive files or directories and trigger code execution, potentially compromising confidentiality, integrity, and availability on the host system. The weakness aligns with CWE‑23, highlighting improper handling of paths.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Access 2016 (including the 32‑bit edition), Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Specific affected release or patch levels are not detailed in the available data.

With a CVSS score of 7.8, the vulnerability is rated moderate‑high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker must supply or trick the target into opening a specially crafted Access file or attempt to perform the traversal on a machine that has the vulnerable application installed. No network‑based exploitation path is indicated in the description.