Loading story…
Researchers disclosed two Microsoft Jet Database Engine vulnerabilities, CVE-2019-1406 and CVE-2019-1250, that can lead to remote code execution when a user opens a specially crafted MDB database file on affected Windows systems. The flaws affect Windows 7 through Windows 10 version 1903 and below and involve the Jet components msjet40.dll and msrd3x40.dll, where malformed database content can corrupt memory and redirect execution flow.
In the CVE-2019-1406 case, STAR Labs said type confusion during ErrOpenDatabase and TblPage::CreateLvSMLocs can make the engine treat attacker-controlled data as a ColumnLvText object, with proof-of-concept analysis showing control of execution through an arbitrary address. For CVE-2019-1250, the researchers traced memory corruption to msrd3x40!Record::IsNull after crafted changes to the database version field altered Jet/Red ISAM processing and reached vulnerable record-retrieval paths. Microsoft was notified of both issues and released patches, later acknowledging the vulnerabilities in its MSRC advisories.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
STAR Labs disclosed analysis of CVE-2019-1406, a type-confusion remote code execution flaw in msjet40.dll. The advisory showed that a malicious MDB file could make the engine dereference attacker-controlled data, with a proof of concept demonstrating control of EIP.
Microsoft patched both Jet Database Engine vulnerabilities and acknowledged them in MSRC advisories. The fixes addressed code-execution risks in msrd3x40.dll and msjet40.dll affecting Windows 7 through Windows 10 version 1903 and below.
STAR Labs disclosed analysis of CVE-2019-1250, a memory-corruption/code-execution flaw in the Microsoft Jet Database Engine's msrd3x40.dll component. The write-up described how a crafted MDB file could alter execution flow and reach the vulnerable Record::IsNull path.
STAR Labs notified Microsoft of two code-execution flaws in the Microsoft Jet Database Engine, later assigned CVE-2019-1250 and CVE-2019-1406. Both issues could be triggered by opening specially crafted MDB database files on supported Windows versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026
Microsoft published multiple security advisories covering **information disclosure** issues across Azure services, Windows components, and Power Automate Desktop. The disclosures include `CVE-2026-23661`, `CVE-2026-23662`, and `CVE-2026-23664` affecting **Azure IoT Explorer**; `CVE-2026-21524` affecting **Azure Data Explorer**; `CVE-2026-25186` affecting **Windows Accessibility Infrastructure (`ATBroker.exe`)**; and an earlier advisory, `CVE-2023-35625`, affecting **Azure Machine Learning Compute Instance for SDK Users**. Microsoft also listed `CVE-2026-26121` as a **spoofing** vulnerability in Azure IoT Explorer, indicating that the Azure IoT Explorer issues extend beyond data exposure alone. The most detailed advisory, **`CVE-2026-40374`**, describes an **Important** information disclosure flaw in **Microsoft Power Automate Desktop** with a **CVSS 3.1 score of 6.5**. Microsoft said a logging issue could cause values stored in variables marked as **Sensitive** to appear in execution logs uploaded to the Power Automate portal, where they may be visible to users with **Owner, Co-Owner, or Runner** permissions for the affected desktop flow. The company assessed exploitation as **less likely**, said the issue was **not publicly disclosed or exploited** at publication, and stated that an official fix is available.
Jun 29, 2026
Microsoft disclosed and patched several remote code execution vulnerabilities affecting **Microsoft Office**, **Excel**, and Windows graphics components, including `CVE-2026-42831`, `CVE-2026-26108`, `CVE-2025-49742`, `CVE-2024-49031`, `CVE-2024-49065`, and `CVE-2026-35421`. The issues span Office document handling, Excel, the **Office Graphics** stack, the **Windows Graphics Component**, and **Windows GDI**, indicating broad exposure across common user-facing software used to process files and render content. Microsoft said `CVE-2026-42831` is a **heap-based buffer overflow** in Microsoft Office that can allow code execution when a user opens a malicious Office file. The flaw carries a **CVSS 7.8** score, requires user interaction, and is **not exploitable through the Preview Pane**; Microsoft also said it was **not publicly disclosed**, **not observed in the wild**, and assessed as **less likely to be exploited**, with a security fix available. The related advisories point to a recurring risk pattern in which crafted documents or graphics content can trigger code execution on victim systems, reinforcing the need to prioritize patching for Office and Windows rendering components.
Jun 29, 2026