Heap-based buffer overflow in Microsoft Office - CVE-2026-109498
Published: November 10, 2026
Vulnerability identifier: #VU164749
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109498
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when processing malicious input with user interaction. A remote attacker can supply crafted input over a network to corrupt heap memory and execute arbitrary code.
Successful exploitation depends on specific application memory conditions that the attacker cannot fully control, making exploitation potentially unreliable.
Affected software
Microsoft Office
How to mitigate CVE-2026-109498
Install security update from vendor's website.
Microsoft Office - addressed in versions 16.0.14334.21048, 16.0.17932.21140