Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally. This flaw arises from insufficient bounds checking when handling heap allocations, leading to a classic out‑of‑bounds write that can be leveraged to overwrite return pointers or function tables. The result is the ability for the attacker to run arbitrary code with the privileges of the logged‑in user. The weakness is a classic example of CWE‑122, which can compromise confidentiality, integrity and availability of the affected system.

Microsoft 365 Apps for Enterprise, Microsoft Access 2016, Microsoft Access 2016 (32‑bit edition), Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024 are all affected. No specific version numbers are listed beyond the product families, so all current installations of these products must be checked for a patch.

The vulnerability has a CVSS score of 7.3, indicating notable severity. The EPSS score is not available, and the vulnerability is not included in CISA’s KEV catalog, suggesting no publicly known exploited instances yet. Because the flaw is local and requires a user to run a crafted Access file, the likely attack vector is a trusted user executing malicious content or a disgruntled insider. The risk is moderate to high if privileged accounts are involved, but there is no evidence of remote exploitation or widespread public attacks as of the latest data.