Key points
- CVE-2026-102850 is a heap-based buffer overflow in Microsoft Office Access.
- The vulnerability allows unauthorized remote code execution over a network.
- Affected versions include Office LTSC 2021, LTSC 2024, and Microsoft 365 Apps.
Microsoft has identified a high-severity vulnerability in Microsoft Office Access. The flaw, tracked as CVE-2026-102850, involves a heap-based buffer overflow that permits unauthorized attackers to execute code. This remote code execution capability operates over a network. The issue affects specific versions of Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. No fix has been confirmed yet in the provided source material.
In plain English
A buffer overflow occurs when a program writes more data to a memory block than it can hold. In this case, the excess data spills into adjacent memory areas, potentially overwriting instructions. An attacker can exploit this by sending crafted data to Office Access. The application then executes the attacker's code instead of its intended operations. This allows code execution by an unauthorized attacker over a network.
The background
The National Vulnerability Database assigns this issue a CVSS score of 8.8, classifying it as high severity. The underlying weakness is identified as CWE-122, a heap-based buffer overflow. As Patch Herald reported on October 13, 2026, Microsoft has been addressing multiple urgent remote code execution flaws across its ecosystem, including QUIC protocol vulnerabilities in Windows 11. This Access vulnerability adds to the current patching burden for enterprise IT teams.
What changes now
Organizations must review their Office installations to mitigate this risk. For Microsoft 365 Apps for Enterprise, the source lists versions before the latest release as affected. Office LTSC 2021 users are affected before version 16.0.14334.20974. Office LTSC 2024 users are affected before version 16.0.17932.21056. These versions are listed as vulnerable in the Microsoft Security Update Guide.
Who needs to act first
Teams usually prioritize systems exposed to untrusted networks or external users. Check whether any Office Access databases are accessible via web servers or shared network drives. Test the update in a controlled environment before wide deployment to ensure compatibility with existing macros and forms. Back up critical databases before applying the patch. If immediate patching is not possible, restrict network access to systems running vulnerable versions of Office Access.
What to do and how to stay safe: Microsoft
- Identify all systems running Microsoft Office Access, particularly those on LTSC or Enterprise plans.
- Verify current version numbers against the affected builds listed in the Microsoft advisory.
- Monitor network logs for unusual traffic targeting Office Access services until patches are confirmed.
- Restrict network access to systems running vulnerable versions of Office Access if updates are delayed.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability require user interaction to exploit?
The source material states it allows an unauthorized attacker to execute code over a network, but does not specify user interaction requirements.
Which specific Office versions are affected?
Microsoft 365 Apps for Enterprise before the latest release, Office LTSC 2021 before 16.0.14334.20974, and Office LTSC 2024 before 16.0.17932.21056.
Is there a fix available for this issue?
No fix has been confirmed yet in the provided source material.
