{"id":"CVE-2026-109493","kind":"vulnerability","aliases":["CVE-2026-109493"],"related":[],"title":"Microsoft Office Access: heap overflow lets an attacker run code after a user opens a crafted file","description":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow (CWE-122) in Microsoft Office Access lets an unauthorized attacker execute code. Microsoft rates it 8.8 High with user interaction required (CVSS:3.1 AV:N/UI:R). A third-party writeup (not Microsoft) says the user must open a crafted database and drag an object from it to another application. No exploitation or public PoC reported. Fixed in the Nov 10, 2026 Office updates.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 build 20527.20196"],"affected":">= 16.0.1, < fixed build per aka.ms/OfficeSecurityReleases","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["access","microsoft-office","other","user-interaction","windows"],"not_affected_if":["access-not-installed"],"how_to_check":"In any Office app: File > Account > About, check the build. Affected if below the fixed build: Office LTSC 2021 < 16.0.14334.21048, Office LTSC 2024 < 16.0.17932.21140; Microsoft 365 Apps: see https://aka.ms/OfficeSecurityReleases for your channel's fixed build (e.g. Current Channel 2610 build 20527.20196). Only matters if Access is installed.","fix":"Install the Nov 10, 2026 Office security update: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Current Channel 2610 build 20527.20196 (other channels per the Microsoft release notes page).","status":"open","published_at":"2026-11-10T19:18:18+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","triaged_at":"2026-11-10T19:33:56+00:00","updated_at":"2026-11-11T00:43:07+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:33:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Office Access: heap overflow lets an attacker run code over network","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Access lets an unauthorized attacker execute code across a network. The sources give no further detail on the trigger or the affected versions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","access","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs code on the affected machine over the network","analyst_note":"Find the Microsoft security update guide entry and confirm affected Office Access builds, fixed versions and whether a user must open a file.","how_to_check":"- unknown","plain_action":"","product_name":"Microsoft Office Access","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":4494,"output_tokens":375,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry and confirm affected Office Access builds, fixed versions and whether a user must open a file.","search":"'-109493':20A,23A '-122':52B '-2026':19A,22A '10':111B '2021':27A '2024':31A '2026':112B '3.1':73B '365':33A '8.8':66B 'access':3A,37B,56B,123C 'allow':124C 'anoth':99B 'applic':100B 'apps':34A 'attack':8A,60B,127C 'av':74B 'base':48B,117C 'buffer':49B,118C 'code':10A,62B,130C 'craft':16A,90B 'cve':18A,21A 'cvss':72B 'cwe':51B 'databas':91B 'drag':93B 'enterprise':36A 'execut':61B,129C 'exploit':102B 'file':17A 'fix':107B 'for':35A 'heap':4A,47B,116C 'heap-bas':46B,115C 'high':67B 'interact':44B,70B 'let':6A,57B 'ltsc':26A,30A 'microsoft':1A,24A,28A,32A,39B,54B,63B,83B,121C 'microsoft-offic':38B 'must':87B 'n/ui':75B 'network':133C 'nov':110B 'object':95B 'offic':2A,40B,55B,113B,122C 'office':25A,29A 'open':14A,88B 'overflow':5A,50B,119C 'parti':80B 'poc':105B 'public':104B 'r':76B 'rate':64B 'report':106B 'requir':71B 'run':9A 'say':84B 'third':79B 'third-parti':78B 'unauthor':59B,126C 'updat':114B 'user':13A,43B,69B,86B 'user-interact':42B 'window':45B 'writeup':81B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-11-11T00:43:07Z","by":"analyst","doc":"https://learn.microsoft.com/en-gb/officeupdates/microsoft365-apps-security-updates","run_id":3388},"products":{"at":"2026-11-11T00:43:07Z","by":"analyst","doc":"https://learn.microsoft.com/en-gb/officeupdates/microsoft365-apps-security-updates","run_id":3388}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeltsc2021","microsoftofficeltsc2024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","microsoft","office"],"labels":["access","high","microsoftoffice","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-109493':20A,23A '-2026':19A,22A '2021':27A '2024':31A '365':33A 'access':3A 'apps':34A 'attack':8A 'code':10A 'craft':16A 'cve':18A,21A 'enterprise':36A 'file':17A 'for':35A 'heap':4A 'let':6A 'ltsc':26A,30A 'microsoft':1A,24A,28A,32A 'offic':2A 'office':25A,29A 'open':14A 'overflow':5A 'run':9A 'user':13A","search_b":"'-122':52B '10':111B '2026':112B '3.1':73B '8.8':66B 'access':37B,56B 'anoth':99B 'applic':100B 'attack':60B 'av':74B 'base':48B 'buffer':49B 'code':62B 'craft':90B 'cvss':72B 'cwe':51B 'databas':91B 'drag':93B 'execut':61B 'exploit':102B 'fix':107B 'heap':47B 'heap-bas':46B 'high':67B 'interact':44B,70B 'let':57B 'microsoft':39B,54B,63B,83B 'microsoft-offic':38B 'must':87B 'n/ui':75B 'nov':110B 'object':95B 'offic':40B,55B,113B 'open':88B 'overflow':50B 'parti':80B 'poc':105B 'public':104B 'r':76B 'rate':64B 'report':106B 'requir':71B 'say':84B 'third':79B 'third-parti':78B 'unauthor':59B 'updat':114B 'user':43B,69B,86B 'user-interact':42B 'window':45B 'writeup':81B","search_c":"'access':123C 'allow':124C 'attack':127C 'base':117C 'buffer':118C 'code':130C 'execut':129C 'heap':116C 'heap-bas':115C 'microsoft':121C 'network':133C 'offic':122C 'overflow':119C 'unauthor':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109493","severity":null,"published_at":"2026-11-10T19:18:18+00:00","modified_at":"2026-11-10T19:18:18+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","fetched_at":"2026-11-10T19:24:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109493:3388","url":"https://learn.microsoft.com/en-gb/officeupdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-11T00:43:07+00:00","modified_at":"2026-11-11T00:43:07+00:00","first_seen_at":"2026-11-11T00:43:07+00:00","fetched_at":"2026-11-11T00:43:07+00:00","note":"Microsoft Office release notes (Nov 10 2026) list CVE under Access; fixed builds LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140; M365 Apps per aka.ms/OfficeSecurityReleases. MSRC guide page is JS-only, not read. Trigger detail (open crafted DB, drag object to another app) is from third-party cybersecurity-help only; Microsoft CVSS has UI:R so user interaction is required. No exploitation reported.","cites":["https://learn.microsoft.com/en-gb/officeupdates/microsoft365-apps-security-updates","https://www.cybersecurity-help.cz/vdb/vulns/164744/"]}],"documents":[{"id":120796,"url":"https://learn.microsoft.com/en-gb/officeupdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120945,"url":"https://www.cybersecurity-help.cz/vdb/vulns/164744/","title":"Heap-based buffer overflow in Microsoft Office - CVE-2026-109493","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}