Microsoft Access vulnerabilities

38 CVEs affecting Microsoft Access, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-69778, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability, published 2007-02-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 43.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack…
• CVE-2003-0665, published 2003-10-20. High severity, CVSS 7.5. EPSS: 30.1% chance of exploitation in the next 30 days. Buffer overflow in the ActiveX control for Microsoft Access Snapshot Viewer for Access 97, 2000, and 2002 allows remote attackers to execute arbitrary code via long parameters to the control.
• CVE-2010-0814, published 2010-07-15. High severity, CVSS 9.3. EPSS: 22.9% chance of exploitation in the next 30 days. The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer…
• CVE-2000-0419, published 2000-05-11. High severity, CVSS 7.5. EPSS: 21.4% chance of exploitation in the next 30 days. The Office 2000 UA ActiveX Control is marked as "safe for scripting," which allows remote attackers to conduct unauthorized activities via the "Show Me" function in Office Help, aka the "Office 2000…
• CVE-2018-8312, published 2018-07-11. High severity, CVSS 7.8. EPSS: 21.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote Code Execution Vulnerability." This affects Microsoft…
• CVE-2010-1881, published 2010-07-15. High severity, CVSS 9.3. EPSS: 20.3% chance of exploitation in the next 30 days. The FieldList ActiveX control in the Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 does not properly interact with the memory-access approach used by Internet…
• CVE-2013-3155, published 2013-09-11. High severity, CVSS 9.3. EPSS: 20.2% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file,…
• CVE-2013-3156, published 2013-09-11. High severity, CVSS 9.3. EPSS: 20% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file,…
• CVE-2013-3157, published 2013-09-11. High severity, CVSS 9.3. EPSS: 18.7% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file,…
• CVE-2008-3068, published 2008-07-07. High severity, CVSS 7.5. EPSS: 17.4% chance of exploitation in the next 30 days. Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a…

Latest

• CVE-2026-69778, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
• CVE-2026-69614, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
• CVE-2026-69529, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
• CVE-2026-69477, published 2026-09-08. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally.
• CVE-2026-64920, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2026-64919, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2026-64914, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2026-64912, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2026-64908, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2026-64906, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.