This vulnerability (CVE-2026-64906) involves a heap-based buffer overflow in Microsoft Office Access, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. This could lead to unauthorized data access, modification, or denial of service within Microsoft 365 Apps for Enterprise environments.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64906 to ensure their environments are updated and protected.