{"id":"CVE-2026-110058","kind":"vulnerability","aliases":["CVE-2026-110058"],"related":[],"title":"Microsoft Office Access: heap overflow lets unauthorized attacker run code","description":"Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Access (CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R) that lets an attacker run code. The CVSS vector says user interaction is required, likely opening a crafted file, but the vendor page was not readable, so affected builds, fixed builds and the trigger are unconfirmed.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Access","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["access","microsoft-office","other","windows"],"not_affected_if":[],"how_to_check":"unknown: check the Microsoft Security Update Guide entry for CVE-2026-110058 for the Access build numbers; compare with File > Account > About Access.","fix":null,"status":"open","published_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","triaged_at":"2026-11-10T19:32:31+00:00","updated_at":"2026-11-11T00:34:08+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-10T19:32:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Office Access: heap overflow lets unauthorized attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Access lets an unauthorized attacker reach code execution over a network. The sources give no affected versions, fixed build, or triggering file type.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","access","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the victim's machine via network attack","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-110058 for affected builds, fixed versions and whether a user must open a file.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office Access","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":4494,"output_tokens":384,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-110058 for affected builds, fixed versions and whether a user must open a file.","search":"'-110058':13A,16A '-2026':12A,15A '8.8':36B 'access':3A,19A,20B,34B,87C 'affect':70B 'allow':88C 'attack':8A,46B,91C 'av':38B 'base':28B,81C 'buffer':29B,82C 'build':71B,73B 'code':10A,48B,94C 'craft':60B 'cve':11A,14A 'cvss':35B,50B 'execut':93C 'file':61B 'fix':72B 'heap':4A,27B,80C 'heap-bas':26B,79C 'interact':54B 'l/pr':40B 'let':6A,44B 'like':57B 'microsoft':1A,17A,22B,32B,85C 'microsoft-offic':21B 'n/ac':39B 'n/ui':41B 'network':97C 'offic':2A,23B,33B,86C 'office':18A 'open':58B 'overflow':5A,30B,83C 'page':65B 'r':42B 'readabl':68B 'requir':56B 'run':9A,47B 'say':52B 'trigger':76B 'unauthor':7A,90C 'unconfirm':78B 'user':53B 'vector':37B,51B 'vendor':64B 'window':25B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["microsoftofficeaccess","officeaccess"],"ptokens":["access","microsoft","office"],"labels":["access","high","microsoftoffice","other","vendor","windows"],"campaign_type":null,"search_a":"'-110058':13A,16A '-2026':12A,15A 'access':3A,19A 'attack':8A 'code':10A 'cve':11A,14A 'heap':4A 'let':6A 'microsoft':1A,17A 'offic':2A 'office':18A 'overflow':5A 'run':9A 'unauthor':7A","search_b":"'8.8':36B 'access':20B,34B 'affect':70B 'attack':46B 'av':38B 'base':28B 'buffer':29B 'build':71B,73B 'code':48B 'craft':60B 'cvss':35B,50B 'file':61B 'fix':72B 'heap':27B 'heap-bas':26B 'interact':54B 'l/pr':40B 'let':44B 'like':57B 'microsoft':22B,32B 'microsoft-offic':21B 'n/ac':39B 'n/ui':41B 'offic':23B,33B 'open':58B 'overflow':30B 'page':65B 'r':42B 'readabl':68B 'requir':56B 'run':47B 'say':52B 'trigger':76B 'unconfirm':78B 'user':53B 'vector':37B,51B 'vendor':64B 'window':25B","search_c":"'access':87C 'allow':88C 'attack':91C 'base':81C 'buffer':82C 'code':94C 'execut':93C 'heap':80C 'heap-bas':79C 'microsoft':85C 'network':97C 'offic':86C 'overflow':83C 'unauthor':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110058","severity":null,"published_at":"2026-11-10T19:18:23+00:00","modified_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","fetched_at":"2026-11-10T19:24:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110058:3363","url":null,"severity":null,"published_at":"2026-11-11T00:34:08+00:00","modified_at":"2026-11-11T00:34:08+00:00","first_seen_at":"2026-11-11T00:34:08+00:00","fetched_at":"2026-11-11T00:34:08+00:00","note":"MSRC Update Guide entry unreachable (JS-only page empty via web-cli/WebFetch; CVRF 2026-Nov doc exceeds fetch size limit; curl not permitted). Affected builds, fixed versions and file-open requirement unconfirmed. Only NVD/CVSS vector (AV:N/AC:L/PR:N/UI:R) known: UI:R suggests user must open a file or interact. Nothing verified. Revisit when MSRC page is readable."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}