A heap‑based buffer overflow in Microsoft Office Access enables an unauthorized attacker to run arbitrary code on a target system over a network. The flaw is classified as CWE‑122 and CWE‑20, indicating improper handling of heap memory and insufficient input validation. Because the vulnerability can be triggered from a remote network source, an attacker who crafts a malicious Office Access file could gain unrestricted execution privileges on the affected machine without interactive user involvement.

The affected products are Microsoft 365 Apps for Enterprise and the long‑term servicing channel releases of Microsoft Office LTSC 2021 and LTSC 2024. No specific version ranges are provided in the CNA data, so any installation of these products that has not applied the latest security update is potentially vulnerable. Administrators should verify that Office Access components are up to date in each version.

The CVSS score of 8.8 marks this flaw as high severity, and the EPSS score is not available, but the lack of a KEV listing does not lower the risk. The vulnerability can be exploited remotely over the network by delivering a crafted Office Access document, which indicates a high likelihood of exploitation in environments that allow remote Office file sharing or that expose Office Access to untrusted inputs. Prompt application of the vendor patch is essential to mitigate the risk.