CVE-2026-69529: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-69529) involves a heap-based buffer overflow in Microsoft Office Access within Microsoft 365 Apps for Enterprise. Exploitation could allow an attacker to remotely execute arbitrary code without privileges, requiring user interaction. The vulnerability affects several versions of the product prior to specific fixed builds. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation could lead to remote code execution with high impact on confidentiality, integrity, and availability. An attacker could run arbitrary code on the affected system over a network without prior privileges, potentially leading to full system compromise.

An official fix is available from Microsoft. Users and administrators should apply the updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft security update guide for the latest patch status and deployment instructions.