CVE-2026-64912 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office and Microsoft 365 Apps for Enterprise deployments should assess exposure and prioritize patching vulnerable versions to prevent potential local code execution.

Why it matters

CVE-2026-64912 allows unauthorized attackers to execute code locally due to a stack-based buffer overflow in Microsoft Office Access. Defenders should prioritize patching vulnerable Microsoft Office and Microsoft 365 Apps for Enterprise versions to prevent potential local code execution.

• Potential local code execution requires patching vulnerable versions
• Verify and apply vendor-provided security updates to prevent exploitation
• Monitor systems for potential suspicious activity related to this vulnerability

Technical summary

A stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Access 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office and Microsoft 365 Apps for Enterprise versions to prevent potential local code execution.

Recommended defensive actions

• Patch vulnerable Microsoft Office and Microsoft 365 Apps for Enterprise versions
• Verify and apply vendor-provided security updates
• Monitor systems for potential suspicious activity

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not specify exploitation or victim information. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Access 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.