A heap-based buffer overflow exists in Microsoft Office Access, enabling an unauthorized attacker to execute code over a network. The description does not specify additional lifecycle impacts beyond the ability to run arbitrary code, and no further detail is provided regarding privilege escalation or persistence.

The vulnerability affects Microsoft products that include Microsoft Access: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No specific version ranges are listed, so any unpatched instances of these product lines may be vulnerable.

The CVSS score of 8.8 indicates a high severity level. The EPSS score is listed as less than 1%, implying a low probability of exploitation at the time of this analysis. The vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is inferred to be remote, as the description states that code execution can occur over a network, typically through delivery of a malicious Access file. No additional prerequisites such as local privileges are detailed in the provided data.