CVSS 8.8: Unauthenticated RCE in Office Access Heap Overflow Threatens M365 and LTSC Users

A heap-based buffer overflow in Microsoft Office Access is enabling remote code execution over a network, according to an official advisory from the Microsoft Security Update Guide. This vulnerability, identified as CVE-2026-102849, carries a CVSS score of 8.8, which the National Vulnerability Database rates as high. The flaw permits an unauthorized attacker to execute code remotely without requiring prior authentication, creating a direct path for system compromise in exposed environments.

Which Microsoft Office builds are exposed?

The National Vulnerability Database specifies that Microsoft 365 Apps for Enterprise are affected until they receive the latest security releases available at the Office security portal. Microsoft also confirms that Microsoft Office LTSC 2021 is vulnerable in versions prior to 16.0.14334.20974. Additionally, Microsoft Office LTSC 2024 installations running versions before 16.0.17932.21056 are subject to this heap-based buffer overflow. Organizations must verify their specific build numbers against these thresholds to determine if their endpoints are currently within the scope of this advisory.

How does this compare to recent Microsoft flaws?

This access vulnerability shares the remote code execution impact seen in other recent Microsoft advisories, though it targets a different component. As Firewall Scoop reported on 2026-10-14, a separate CVSS 9.8 vulnerability allowed unauthenticated remote code execution via a buffer overflow in Windows Error Reporting. While that flaw targeted the error reporting subsystem, this new issue resides within Office Access. Both incidents highlight the persistent risk of heap-based buffer overflows in Microsoft software, where memory management errors can be exploited to achieve arbitrary code execution without user interaction or authentication.

What is the technical nature of the flaw?

The core issue is a heap-based buffer overflow, categorized under CWE-122 in the Common Weakness Enumeration. According to the NVD record, this weakness occurs when a program writes data beyond the boundaries of a heap-allocated buffer. In this case, an attacker can trigger the overflow remotely over a network connection. The exploit does not require the attacker to be logged into the system or possess valid credentials, as the advisory notes the attacker is unauthorized. This lack of authentication requirement significantly lowers the barrier for exploitation, allowing threat actors to target any machine running the vulnerable Access versions that are reachable over the network.

What is the current status of fixes?

Microsoft has confirmed the existence of the vulnerability and has defined the specific version thresholds for patched builds. For Microsoft 365 Apps for Enterprise, the fix is available through the standard channel referenced in the advisory. For LTSC 2021 and 2024 users, the remediation is tied to updating to build 16.0.14334.20974 or 16.0.17932.21056, respectively. Until these specific versions are deployed, the systems remain vulnerable to remote code execution. There is no indication in the source material of a workaround that mitigates the risk without applying the software update.

Detection notes

Security operations teams should monitor network traffic for unexpected connections from Office Access processes, particularly to external or unusual internal endpoints. Look for anomalous memory allocation patterns or heap corruption indicators in crash dumps and application logs. Check for sudden process spawns originating from Office executables that do not match typical user behavior. Verify that file integrity monitoring alerts are not being triggered by known safe macros. Ensure that endpoint detection and response tools are configured to alert on unauthorized remote code execution attempts, regardless of the initiating application.

Background: Buffer overflow vulnerabilities

A buffer overflow vulnerability causes a crash or exploit when a program writes more data into a fixed-size memory buffer than it can hold. This overwrites adjacent memory, including return addresses. Attackers manipulate this overflow to inject malicious code or redirect execution. The root cause is missing bounds checking during data input or processing.

Read the full guide: What Causes a Buffer Overflow Vulnerability: The Memory Logic Breakdown

What to do and how to stay safe: Microsoft

• Inventory all endpoints to identify those running Microsoft Office LTSC 2021 or 2024 and check their current build numbers against the vulnerable versions listed in the advisory.
• Prioritize deploying the security updates for Microsoft 365 Apps for Enterprise and the specific LTSC builds to patch the heap-based buffer overflow immediately.
• Restrict network access for Office Access processes where possible, limiting their ability to initiate outbound connections to known malicious or unexpected destinations.
• Review firewall rules and proxy logs for any recent successful connections from Office Access to external IP addresses that do not correspond to legitimate service traffic.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102849?

The National Vulnerability Database rates CVE-2026-102849 with a CVSS score of 8.8, which is classified as high severity.

Does this vulnerability require user authentication?

No, the advisory states that the heap-based buffer overflow allows an unauthorized attacker to execute code over a network without authentication.

Which Office LTSC versions are affected?

Microsoft Office LTSC 2021 versions before 16.0.14334.20974 and Microsoft Office LTSC 2024 versions before 16.0.17932.21056 are affected.