JetDatabaseWriter

Security vulnerability analysis

Last reviewed: 2026-10-07. Source review began at 0c9adb86fad8a3aa8c552dcb0a3b8055cb66af18; the code and tests linked below include the resulting hardening.

This is a bounded CVE survey and a review of the library’s defenses against untrusted databases. It is not a claim that every hostile input is safe. The Microsoft CVEs below affect Microsoft’s native components, not this independent managed implementation. A similar regression test demonstrates one library behavior; it does not reproduce or remediate the vendor’s CVE.

Scope and trust boundaries

The input is an attacker-controlled MDB/ACCDB file or stream: page headers, schema, indexes, long values, attachments, linked-source metadata, calculated expressions and encryption descriptors are all untrusted. Important outcomes are bounded work/allocation, deliberate corruption errors, no unauthorized file access, and unchanged database bytes when a write is refused.

Production parsing does not delegate to Jet/ACE/DAO, instantiate ActiveX, execute VBA/macros, or launch embedded objects. ODBC links are metadata-only: read-through is refused before connection. Linked Access and text sources do perform filesystem I/O under the caller’s path policy. Calculated expressions run in a restricted evaluator; they do not provide general Access/VBA execution.

Native DAO interoperability tests and diagnostic helpers are a separate execution boundary and require a patched Microsoft installation. A host that opens the output in Office is also outside the managed parser’s boundary. A managed implementation still needs resource, arithmetic and access checks; managed memory safety does not rule out denial of service or disclosure.

Defenses and evidence

These are implemented checks with representative regressions, not completed audits of whole attack surfaces. Test names identify evidence more reliably than historical test counts.

Surface Current controls and representative evidence Limits of the evidence
Internal CFB/OLE parser Physical-sector bounds, FAT/DIFAT cycle checks, disjoint ownership for metadata/data sectors and extracted mini-sectors, exact stream lengths, cancellation and a default 256 MiB container/decoded-stream budget. CompoundFileCorruptionTests checks shared-chain amplification and truncated chains; CompoundFileOwnershipTests checks overlapping starts/tails and metadata sectors; CompoundFileReaderTests checks malformed directory names. Office compound packages are refused as public database inputs; these checks serve internal diagnostics/test support. Independent CFB hardening is unrelated to Equation Editor CVEs. The budget is not a process-wide peak-memory guarantee; transient buffers also allocate.
TDEF chains MaxTableDefinitionBytes defaults to 16 MiB for readers/writers and follows linked readers. Cyclic, truncated and wrong-type continuation pages fail deliberately; buffer growth is amortized and the limit is checked before reading an excess page. LogicalTDefChainTests. A per-definition budget; aggregate catalog work and every schema-edit refusal path are not established by these tests.
Table counts, row directories and variable-column slices Descriptor/page bounds, count limits and slice validation. CveMitigationTests requires its fixtures and mutation targets; its underflow regression constructs and corrupts an actual valid variable-column trailer. Synthetic weakness-class regressions, not native CVE exploit files. Invalid-data handling must still be checked across every read/write API.
MEMO/OLE long values Exact declared-length reads, chain-cycle detection and MaxLongValueBytes: 16,777,215 bytes by default, configurable through the native 30-bit maximum. LongValueCorruptionTests. Raising the budget permits larger allocations. Aggregate values, large native fixtures and complete strict/lenient surface coverage remain separate requirements.
Attachments MaxAttachmentContentBytes defaults to 64 MiB including extension metadata; MaxAttachmentContentBytesPerOperation defaults to 256 MiB shared across one attachment read/table scan. Declared/actual expansion, checksum validation and cancellation checkpoints around inflation reads. AttachmentCorruptionTests, AttachmentResourceLimitTests. Multi-table reads reset the content budget per table. Compressed-input/CPU work and synchronous decompressor, checksum and copy intervals remain separate bounds.
Agile XML/password work DTDs prohibited, resolver disabled, descriptor/depth/parameter checks before hashing; default descriptor limit 1 MiB and spin budget 1,000,000 (format maximum 10,000,000). AgileDescriptorCorruptionTests. Current supported AES-CBC/SHA512 combinations do not establish all native ACE providers.
Agile package integrity Present dataIntegrity requires both correctly sized encrypted fields; HMAC is verified over the encrypted package before plaintext decryption. Writer and reader use the salt-sized HMAC key required by MS-OFFCRYPTO 2.3.4.14. AgileEncryptionTests. An absent integrity element is accepted and provides no package authentication. Native ACE page encryption has no EncryptedPackage HMAC. Synthetic package round trips are not native Access interoperability evidence.
Linked Access sources Explicit LinkedSourceResolver capabilities; exact supplied stream only, detached metadata, inherited budgets and default depth 32. No catalog-path, filename, lockfile or journal opens. LinkedSourceCapabilityTests. The host authorizes the actual resource and supplies an isolated, committed snapshot. Lexical paths do not establish physical identity; aliases remain bounded by the depth limit.
Linked text sources and CSV Explicit resolver for the final source, lexical filename confinement; record and field limits 1,048,576 characters, 255 columns, cancellation and preview stopping. LinkedTextTableTests. Source-byte and materialized-row limits default to null. Row caps exclude streaming/count scans; configured byte limits check supplied stream length and consumption, including growth. The host supplies an authorized, isolated stream.
Calculated expressions Row-local supported AST, length/nesting/argument/reference limits, generated text cap 32,768 characters and 100 ms LIKE regex timeout. CalculatedColumnWriteTests. Individual-expression limits do not bound aggregate row work. Unsupported Access functions/domain aggregates are refused, not implemented.
Writes and schema preservation Validation, transactions and fault regressions cover selected mutation paths. Open work tracks preservation/refusal requirements. No claim of complete crash recovery, application-object preservation or malicious-schema mutation coverage.

The native encryption evidence distinguishes Microsoft-produced fixtures from package primitives and library-generated fixtures. RC4/password-only legacy formats and unauthenticated page encryption must not be described as authenticated protection against malicious changes.

CVE-to-test convention

Each CVE has exactly one inventory row below. A row either names one canonical regression or explains why a direct correspondence is not applicable.

Run pwsh -NoProfile -File scripts/check-security-traceability.ps1 to check inventory/trait agreement, duplicate rows, missing mappings and adjacent Fact/Theory attributes. This is a lexical source check; hosted test discovery and execution provide the runtime evidence. CI runs this check in the library analyzer job. To select an analogue on hosted CI or during focused debugging, use the test runner’s --filter-trait CveAnalogue=CVE-2020-1400 option. An N/A row deliberately has no fake test.

Sourced CVE inventory

The scope is the original 36 IDs, plus Access entries in Microsoft’s Office security release notes and the Jet Red/ACE/Access titles in the MSRC 2019–October 2026 monthly records, checked through 2026-10-07 (including the current-month out-of-band record). The deduplicated inventory contains 141 IDs. Sources are linked per ID; more specific mechanisms cite ZDI or Microsoft supporting material. This does not enumerate every historical Office/Windows CVE, unpublished vulnerability, or host-runtime advisory. Vendor CVSS scores are not severity ratings for JetDatabaseWriter; consult the linked record for its version, vector and affected products.

The Equation Editor entries are not DIFAT bugs, and the Office disclosure entries do not document CFB sector-padding leaks. The 2019/2020 Jet batches have different or undisclosed causes and cannot be labeled one count/offset bug. Historical MSRC and current CNA/ZDI scores can differ; omitting a provider and date obscures that distinction. Microsoft separately documents external database queries for the 2021 Jet Red/ACE RCE; the managed ODBC refusal is only a related boundary check.

CVE and primary record Disclosed issue / evidence Library correspondence
CVE-2005-0944 Native Jet input-validation RCE; precise mechanism undisclosed. N/A: native Jet absent; a possible duplicate is not proof of a column-count trigger.
CVE-2007-6026 Native Jet stack overflow from modified column count. ✅ Analogue: CveMitigationTests.ReadTable_CorruptNumCols_0xFFFF_DoesNotCrashOrOom (test); column-count rejection, not native stack overwrite.
CVE-2008-1092 Microsoft identifies the same Jet issue as the preceding column-count CVE. ✅ Analogue: CveMitigationTests.ReadTable_CorruptNumCols_4097_DoesNotCrashOrOom (test); column-count boundary, not the Word delivery vector.
CVE-2010-1881 ACCWIZ FieldList ActiveX initialization memory corruption. N/A: no Access wizard control instantiation.
CVE-2015-1770 Office uninitialized-memory RCE. N/A: native Office execution absent; managed code alone is not a disclosure proof.
CVE-2017-11882 Equation Editor memory corruption; Microsoft analysis. N/A: no Equation Editor invocation; no DIFAT correspondence.
CVE-2018-0802 Equation Editor memory corruption. N/A: no Equation Editor invocation; no CFB parser correspondence.
CVE-2018-8423 Jet index-management out-of-bounds write (ZDI-18-1075). ✅ Analogue: CveMitigationTests.ReadTable_CorruptNumRealIdx_0x7FFFFFFF_DoesNotCrashOrOom (test); index-count bounds, not a verified native index-ordinal exploit.
CVE-2019-0538 Jet memory-handling RCE; precise trigger unspecified. N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0560 Office process-memory disclosure; no documented CFB-padding mechanism. N/A: native Office absent; exact-size CFB tests do not reproduce this disclosure.
CVE-2019-0575 Jet out-of-bounds read (ZDI-19-011). N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0576 Jet memory-handling RCE; precise trigger unspecified. N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0577 Jet out-of-bounds read (ZDI-19-012). N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0578 Jet memory-handling RCE; precise trigger unspecified. N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0579 Jet memory-handling RCE; precise trigger unspecified. N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0580 Jet out-of-bounds write (ZDI-19-006). N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0581 Jet out-of-bounds write (ZDI-19-007). N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0582 Jet uninitialized pointer (ZDI-19-008). N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0583 Jet integer underflow (ZDI-19-009). ✅ Analogue: CveMitigationTests.ReadTable_CorruptVarColOffsets_IntegerUnderflow_DoesNotCrash (test); negative slice-length rejection; native field layout unverified.
CVE-2019-0584 Jet out-of-bounds write (ZDI-19-010). N/A: native Jet absent; no verified managed test for this particular memory defect.
CVE-2019-0595 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0596 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0597 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0598 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0599 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0617 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0625 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0671 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0672 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0673 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0674 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0675 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0748 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0823 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0824 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0825 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0826 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0827 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0846 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0847 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0851 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0877 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0879 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0889 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0890 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0891 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0893 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0894 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0895 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0896 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0897 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0898 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0899 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0900 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0901 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0902 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0904 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0905 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0906 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0907 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0908 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0909 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0945 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0946 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0947 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-0974 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1146 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1147 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1155 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1156 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1157 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1240 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1241 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1242 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1243 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1246 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1247 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1248 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1249 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1250 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1358 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1359 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1400 Native Access Information Disclosure; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1402 Office process-memory disclosure; no documented CFB-padding mechanism. N/A: native Office absent; exact-size CFB tests do not reproduce this disclosure.
CVE-2019-1406 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2019-1463 Native Access Information Disclosure; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0760 Office loads arbitrary type libraries. N/A: no COM type-library loading in production parsing.
CVE-2020-0889 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0953 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0959 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0960 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0961 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0988 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0992 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0994 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0995 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-0999 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1008 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1039 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1051 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1074 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1174 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1175 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1176 Native Jet Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1208 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1236 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1400 Jet integer underflow (ZDI-20-924). ✅ Analogue: CveMitigationTests.ReadTable_CorruptVarColOffsets_IntegerUnderflow_DoesNotCrash (test); negative slice-length rejection, not the native write primitive.
CVE-2020-1401 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1407 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1473 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1557 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1558 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1564 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-1582 Access memory-handling RCE. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-16924 Jet memory-handling RCE; a shared precise count/offset cause is not established. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-16957 Office ACE memory-handling RCE. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2020-17062 Native ACE Remote Code Execution; exact managed correspondence unverified. N/A: native Microsoft engine absent; no verified managed reproducer.
CVE-2021-28455 Jet Red/ACE external database-query RCE (Microsoft guidance). ✅ Analogue: LinkedTableTests.LinkedTable_ReadLinkedOdbcTable_ThrowsNotSupportedWithoutOpeningOdbc (test); ODBC execution refusal; library has no native SQL query engine.
CVE-2021-38646 Office ACE RCE. N/A: native ACE absent; precise managed correspondence unverified.
CVE-2021-40444 MSHTML/ActiveX document RCE. N/A: no MSHTML hosting or ActiveX execution.
CVE-2021-41368 Access ACCDB parsing use-after-free RCE (ZDI-21-1309). N/A: native Access absent; no verified managed reproducer.
CVE-2021-42293 Jet Red/ACE elevation-of-privilege title; published vector has availability-only impact. N/A: native engine absent; title/vector alone do not establish a parser trigger.
CVE-2023-29333 Microsoft Access denial of service. N/A: native Access absent; no verified managed reproducer.
CVE-2023-36884 Windows Search RCE. N/A: no Windows Search invocation; a CFB mechanism is not established.
CVE-2023-38545 curl SOCKS5 heap overflow, also listed in Access release notes. N/A: production library does not use curl or SOCKS5.
CVE-2024-49142 Access use-after-free RCE. N/A: native Access absent; managed bounds tests do not reproduce native lifetime bugs.
CVE-2025-21186 Access heap-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2025-21366 Access use-after-free RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2025-21395 Access heap-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2025-26630 Access use-after-free RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2025-62552 Access relative-path-traversal RCE (CWE-23). ✅ Analogue: LinkedTableTests.LinkedTable_ReadLinkedTable_RelativeTraversalPath_IsBlockedByDefault (test); lexical traversal refusal only; native execution path unverified.
CVE-2026-64906 Access heap-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-64908 Access heap-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-64912 Access stack-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-64914 Access heap-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-64919 Access stack-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-64920 Access heap-buffer-overflow RCE. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-69477 Access heap-buffer-overflow RCE requiring an authorized attacker. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-69529 Access heap-buffer-overflow RCE over a network. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-69614 Access stack-buffer-overflow/input-validation RCE over a network. N/A: native Access absent; no verified managed reproducer for the disclosed defect.
CVE-2026-69778 Access heap-buffer-overflow RCE over a network. N/A: native Access absent; no verified managed reproducer for the disclosed defect.

Dependencies and validation limits

On 2026-10-07, all six packages.lock.json files (62 distinct package/version pairs, direct and transitive including development tools) were compared using NuGet’s version-range parser with both pages of the official NuGet vulnerability feed. The base snapshot was updated 2026-10-06 23:47:38 UTC and the incremental snapshot 2026-10-07 17:47:42 UTC. No matching published advisory ranges were returned. This is a dated feed result, not proof of vulnerability absence; it excludes host .NET/Office/OS versions and advisories missing from that feed. See the NuGet API definition.

Directory.Build.props sets NuGetAuditMode=all; CI restores locked packages and treats warnings as errors. SDK analyzers and banned APIs add useful checks, but do not prove taint coverage for file bytes or linked-source authorization; see the static-analysis coverage clarification. The GitHub code-scanning endpoint returned “no analysis found” during this review, and the available token could not read Dependabot alerts. Neither response is evidence of zero findings.

Normal CI selects strict Release analyzer/package jobs and every ordinary partition in each runtime/library combination. A separate required DAO120 lane uses pinned Access on the exact analyzed artifacts; its selected methods cannot skip. DAO skips outside that inventory remain native-interoperability gaps. The three explicit fuzz harnesses are not ordinary-suite coverage: the hosted fuzz workflow runs separate processes with time/memory limits and retained reproductions. The fuzzing design describes structural mutation scheduling, operation reachability, rejection oracles and bounded reduction. Random bounded mutations and a successful run do not establish exhaustive path coverage. Final acceptance must cite the exact integrated SHA and completed hosted verdict; source inspection and focused local reproductions are not that gate.

Remaining hostile-input work

The open requirements remain in PLAN.md. In particular:

Do not replace these scoped requirements with “all CVEs mitigated” or “no remaining recommendations.” A new CVE, parser path, option or test change must update its source/disposition, corresponding trait where justified, and the limits of the evidence together.

This site is open source. Improve this page.