CVE-2026-64908

The CVSS 7.8 on this heap overflow in Microsoft Access would, in any previous decade, be a drop-everything moment. The EPSS score of 0.0031 tells a different story: the exploitation probability models treat this as a low-likelihood target. That gap deserves interrogation, because the explanation matters enormously for how you should prioritize this patch. Three hypotheses compete. First, Access is a declining platform with shrinking deployment, making it a low-value target even when exploitable. Second, the exploitation prerequisites are genuinely steep — this is a heap overflow requiring a victim to open a malicious .mdb or .accdb file, and modern heap mitigations have raised the bar substantially since the 2000s. Third, this is simply too recent for weaponized exploits to have materialized yet, and the EPSS will shift as the vulnerability ages. The honest answer is that the EPSS doesn't distinguish between these — and that's where the deeper risk analysis begins. The organizations still running Access in 2026 are disproportionately running it on legacy infrastructure with constrained patching cycles and older Windows versions. The EPSS may correctly model the broad population, but the remaining exposed population is precisely the subset with the weakest security posture. That's a survivorship bias in the scoring that works against you. More concerning: the "local code execution" framing undersells the actual attack surface. In practice, this means send a file, get the user to open it. The macro and document-based attack ecosystem has spent twenty years perfecting exactly this chain. The EPSS weights this as a hard prerequisite, but the barrier is meaningfully lower than the label suggests. There's also the blast radius question the EPSS structurally cannot answer. Access doesn't live in isolation — it has ODBC/SQL Server linked tables, VBA automation calling into Excel and Outlook, SharePoint connections. A heap overflow giving you code execution as the Access user potentially reaches authentication contexts and backend databases that the CVSS base metric never captures. The practical decision framework: treat the CVSS 7.8 as your upper bound on urgency and the EPSS 0.0031 as the lower bound. If your organization has significant Access deployment managing production data through linked tables, or runs Access users with domain credentials and database write access, weight toward the upper bound regardless of what the exploitation probability models say. The score tells you about aggregate attacker behavior — it tells you nothing about whether a sophisticated actor who has already mapped your legacy infrastructure would consider this a valuable stepping stone. Watch for the temporal trap: low EPSS on high-severity vulnerabilities creates organizational behavior where security teams deprioritize the patch, it sits in the queue, and sixty days later you have an unfixed disclosed heap overflow with code execution potential in an environment nobody is watching closely because everyone agreed it was probably fine. The EPSS becomes dangerous not as a current exploitation probability but as an exposure duration amplifier.

Reviewed through automated stages and approved by a human before publication.