Microsoft Visio CVE-2026-102855

Exploitation requires the victim to open an attacker-crafted Visio document (e.g., .vsdx/.vsd) in Microsoft Office Visio; the heap overflow is triggered during file parsing. The decisive limiting factor is UI:R - there is no automatic or server-side trigger, so a user must be socially engineered into opening the file, and code runs only in that user's context (S:U, no privilege escalation implied). No authentication is required of the attacker (PR:N). Exploitation is limited to installations of Visio within the affected builds; endpoints without Visio installed are not affected, and up-to-date builds at or above the fixed versions are not vulnerable.

This is a genuine high-priority vulnerability that warrants prompt patching, though not an emergency relative to unauthenticated server-side RCE. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution that is gated by one critical mitigating factor: UI:R, meaning a user must open a malicious Visio document. The 'network' attack vector here follows Microsoft's convention for file-delivery (email/web-hosted document) rather than a listening network service, so real-world exploitation hinges on social engineering rather than direct remote reach. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the priority rests on the severity and the historically high attacker interest in Office document RCE rather than on confirmed in-the-wild activity. Key signals are consistent (high technical impact plus required user interaction); the main data gap is the absence of any exploitation-likelihood telemetry (EPSS/KEV/SSVC), which should be re-checked against live feeds before finalizing prioritization.

An attacker emails a crafted Visio (.vsdx/.vsd) file to a targeted user, or hosts it on a web page or shared drive. When the victim opens the file in Microsoft Office Visio, a heap-based buffer overflow (CWE-122) is triggered during parsing, allowing arbitrary code execution in the context of the current user. No public proof-of-concept was provided in the input, and exploitation requires the victim to open the malicious file.