A critical heap-based buffer overflow in Microsoft Account (CVE-2026-56165) allows an unauthenticated, remote attacker to execute arbitrary code over a network, earning a maximum-tier CVSS score of 9.8.
What Is It
CVE-2026-56165 is a heap-based buffer overflow (CWE-122) in Microsoft Account. According to Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it is reachable over the network, requires low attack complexity, needs no privileges, and requires no user interaction, while fully compromising confidentiality, integrity, and availability.
Why It Matters
An attacker who exploits this vulnerability can run code remotely without authentication or user interaction, the most dangerous class of software flaw. The combination of network attack vector, no privileges required, no user interaction, and high impact across all three security properties is what drives the near-maximum severity rating. Microsoft tags the affected component as an "exclusively-hosted-service," indicating it is a cloud-hosted service rather than on-premises software.
What's Vulnerable
The affected product is Microsoft Account (vendor: Microsoft). Microsoft's data lists the affected version as "-", and no specific affected CPE configurations are provided in the NVD record.
Patch Status
The vulnerability is tagged as an exclusively-hosted-service, meaning remediation is handled by Microsoft on the service side rather than requiring customer-installed patches. No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation or a mandated remediation deadline in the available source material. Consult Microsoft's Security Response Center advisory for the current status and any required action.