CVE-2026-69477: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-69477 and classified under CWE-122 (Heap-based Buffer Overflow), exists in Microsoft Office Access component of Microsoft 365 Apps for Enterprise. It enables an authorized attacker with local privileges to execute arbitrary code by exploiting a heap overflow condition. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity, with attack vector local, low attack complexity, requiring privileges and user interaction. Microsoft has released official fixes for affected versions, and the vendor advisory provides detailed remediation guidance.

Successful exploitation allows an authorized local attacker to execute arbitrary code with the privileges of the user running the application. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69477. Since this is a local vulnerability requiring user interaction and privileges, applying the patch is the primary mitigation.