Microsoft Fixes High-Severity Access Heap Overflow in Office Apps

Microsoft has addressed a high-severity vulnerability in Office Access that permits remote code execution. The flaw, tracked as CVE-2026-102849, stems from a heap-based buffer overflow. Attackers can exploit this defect over a network without prior authentication. This issue impacts organisations running Microsoft 365 Apps for Enterprise, as well as those on Office LTSC 2021 and 2024.

Root cause

The underlying technical issue is a heap-based buffer overflow, classified under CWE-122. This type of memory corruption occurs when data exceeds the allocated buffer space in the application’s heap. In Office Access, this flaw allows an unauthorised attacker to execute arbitrary code. The vulnerability exists in the way the application handles specific data structures, leading to potential memory manipulation by remote adversaries.

Attack path

An attacker can exploit this vulnerability remotely over a network. No prior authentication is required to trigger the buffer overflow. Once the flaw is successfully exploited, the attacker gains the ability to execute code on the affected system. This remote code execution capability allows adversaries to potentially take full control of the compromised host, bypassing standard security controls.

Affected versions

• Microsoft 365 Apps for Enterprise: versions prior to the latest security release.
• Microsoft Office LTSC 2021: versions before build 16.0.14334.20974.
• Microsoft Office LTSC 2024: versions before build 16.0.17932.21056.

Mitigation

• Apply the latest cumulative updates for Microsoft 365 Apps for Enterprise immediately.
• Update Office LTSC 2021 installations to build 16.0.14334.20974 or later.
• Update Office LTSC 2024 installations to build 16.0.17932.21056 or later.
• Restrict network access to systems running vulnerable versions of Office Access where possible.

What it means for organisations

IT leaders must verify that all endpoints have received the latest Office updates. Teams should review inventory lists to identify any legacy LTSC deployments that may have been missed. Security operations centres need to monitor for unusual network activity originating from Access processes. Procurement teams should assess supplier contracts to ensure timely patch delivery. Internal communication should alert users to potential phishing attempts that might exploit unpatched systems.

Background: Phishing

Phishing uses deceptive messages to steal data, while vishing uses voice calls to manipulate victims. The core difference is the medium. Email relies on visual cues and links, whereas voice relies on urgency and tone. Both aim for credential theft, but voice attacks bypass text-based security filters entirely.

Read the full guide: Phishing vs Vishing: How Audio Bypasses Your Defences

What to do and how to stay safe: Microsoft

• Audit your environment to confirm all Office Access instances are patched to the specified builds.
• Monitor network logs for suspicious outbound connections from workstations running Office applications.
• Ensure endpoint detection and response tools are updated with the latest threat signatures.
• Review access policies to limit exposure of Office Access files to untrusted network zones.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-102849?

The National Vulnerability Database rates this vulnerability as HIGH with a CVSS score of 8.8.

Which Microsoft products are affected by this heap overflow?

Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 are affected.

Is authentication required to exploit this vulnerability?

No, the advisory states that an unauthorised attacker can execute code over a network.