---
id: "CVE-2026-111301"
page: "https://infrastack.ai/live/CVE-2026-111301"
kind: "vulnerability"
aliases: ["CVE-2026-111301"]
title: "Microsoft Office Access: heap overflow lets a remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Office Access", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["access", "microsoft-office", "other", "user-interaction-required", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:18:27+00:00"
first_seen_at: "2026-11-10T19:24:29+00:00"
updated_at: "2026-11-11T00:26:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111301", "first_seen_at": "2026-11-10T19:24:29+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-111301", "first_seen_at": "2026-11-11T00:26:53+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-111301"]}]
exploit_sources: []
---

# Microsoft Office Access: heap overflow lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-111301 (this .md is for agents)

A heap-based buffer overflow in Microsoft Office Access can be triggered over a network by an unauthorized attacker. Successful exploitation allows arbitrary code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office Access affected range not listed fixed no fixed version listed

## How to check

Check installed Access/Office build against the fixed build listed for CVE-2026-111301 in the Microsoft Security Update Guide (msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111301); fixed build numbers unconfirmed. Microsoft's Nov 10, 2026 Office release notes list the patch-level builds (e.g. Current Channel 2610 build 20527.20196), but I did not confirm they carry this fix.

## Fix

Install the November 2026 Microsoft Office security update (released Nov 10, 2026); exact fixed build unconfirmed.

## Timeline

- 2026-11-10T19:24:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111301
- 2026-11-11T00:26:53+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-111301 — MSRC page is JS-only and returned no text; builds/fixed versions not confirmed. From the Microsoft-issued CVSS in NVD: network vector, user interaction required (UI:R), so a victim must open a crafted file or content. Not in KEV, no exploitation seen. Nothing verified.

## Documents

- [describes] NVD CVE-2026-111301 (CNA: Microsoft) https://nvd.nist.gov/vuln/detail/cve-2026-111301

## From the sources

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_