EUVD-2026-99040
GHSA-rhqg-54p5-89mw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Visio file via email
-
DeliveryVictim opens malicious document
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted Visio drawing file in Microsoft Office Visio (UI:R in the vector) - it is NOT self-propagating and will not trigger without that user action. No authentication or elevated privileges are needed (PR:N), and delivery is remote (AV:N), typically via phishing email or a hosted file. The principal LIMITING factors are: (1) the target must have Microsoft Office Visio installed (a separately licensed Office component, not present on every Office install), and (2) the user must be convinced to open the attacker-supplied file, so email filtering, Protected View, and Mark-of-the-Web/attachment blocking meaningfully reduce real-world exploitability. |
| Impact | This is a genuine high-priority issue rather than a high-CVSS paper tiger, but with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction - the classic profile of a malicious-document attack where the victim must open a crafted Visio file. The HIGH impact across confidentiality, integrity, and availability (full code execution in the user's context) is consistent with the CWE-122 heap-based buffer overflow. However, the signals are incomplete: there is NO EPSS score provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - the only source is the Microsoft MSRC advisory. So while the technical severity is real, there is currently no evidence of active exploitation or available exploit code, which lowers the IMMEDIATE operational urgency relative to a KEV-listed bug. Treat this as a priority patch for environments running Visio (file-parsing RCE in Office components are historically popular with phishing/malspam actors), while recognizing exploitation status is unconfirmed. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Visio (.vsdx/.vsd) file to a target and lures them into opening it; parsing the malicious file triggers a heap-based buffer overflow that executes arbitrary code in the context of the current user. No authentication is required (PR:N), but the attack cannot proceed without the victim opening the file (UI:R). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Office Visio enables remote code execution when a victim opens a maliciously crafted Visio drawing file (CVSS 8.8, CWE-122). The attack is unauthenticated (PR:N) and remotely deliverable (AV:N), but requires user interaction (UI:R): the target must have the separately licensed Visio application installed and must be persuaded to open the attacker-supplied file, typically delivered by phishing email or a hosted download. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; real-world risk is materially reduced by Protected View, Mark-of-the-Web, attachment blocking, and the fact that Visio is not present in most Office installations.
RemediationAI
Patch available per vendor advisory: Microsoft's MSRC update guide entry for CVE-2026-102857 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102857) is the authoritative source for the fixed build; apply the current Microsoft Office/Visio security updates through Windows Update, Microsoft Update, or the Microsoft 365 Apps update channel, and verify the installed Visio build matches the version Microsoft identifies as remediated. Because the exploit path depends entirely on a user opening a weaponized drawing, layer the following compensating controls while patching: keep Microsoft Defender and Office's Protected View, Application Guard, and Mark-of-the-Web attachment handling enabled (trade-off: some legitimate files opened from the internet will render in a restricted read-only view, and users may need to explicitly unblock trusted documents); configure the email gateway and endpoint mail clients to block or quarantine Visio attachment types (.vsd, .vsdx, .vsdm, .vssx, .vstx) from external senders, and disable Outlook/Explorer file preview for those extensions (trade-off: business workflows that legitimately exchange Visio diagrams with partners will be disrupted and need an approved file-transfer channel); and enable the Microsoft Defender Attack Surface Reduction rules that govern Office child-process creation and executable content from Office documents, tested in audit mode first to avoid breaking Visio add-ins or macros. Removing or not deploying Visio on hosts that do not need it eliminates the attack surface entirely, and restricting which users are licensed for Visio limits the population exposed to UI:R phishing lures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, a heap-based buffer overflow, in the code Microsoft Office Visio uses to parse drawing files. Visio file formats (the legacy binary .vsd and the OOXML-based .vsdx/.vsdm packages) contain structured streams describing shapes, stencils, embedded objects, and geometry, and the parser allocates heap buffers sized from fields in that untrusted input. If a length or count field is not validated against the actual amount of data that follows, a write can exceed the allocated buffer and corrupt adjacent heap metadata, which an attacker can steer toward controlled code execution in the context of the Visio process. Because Visio is a desktop rendering/parsing application rather than a network service, exploitation is file-driven rather than socket-driven: the malicious document is the delivery vector, and the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects remote delivery with a low-complexity exploit that yields high confidentiality, integrity, and availability impact once the file is opened. No CPE strings were supplied in the source data, so the precise affected build range cannot be enumerated from the provided intelligence; the authoritative product/version mapping is the Microsoft Security Response Center update guide entry referenced by NVD.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote malicious-file delivery (AV:N) needs no auth (PR:N) but requires the user to open the document (UI:R); heap overflow yields full code execution, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity heap buffer overflow in Microsoft Visio (CVE-2026-102857) allows an attacker to execute arbitrary code on the workstation of any employee who opens a maliciously crafted Visio drawing file. Exposure is limited to staff who have the separately licensed Visio application installed, and exploitation requires the user to open an attacker-supplied file, but a successful attack would give an intruder a foothold running with the victim's own privileges. Leadership should treat this as a targeted-phishing risk concentrated among a small group of process and diagramming power users rather than a fleet-wide exposure, and should note that no vendor-released patch has been identified at time of analysis and no public exploit code has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce Protected View and Mark-of-the-Web for Visio documents; block or quarantine external Visio attachments and hosting links at the email gateway and web proxy; restrict the file types that can be opened from untrusted sources; uninstall or deny-launch Visio on endpoints where it is not operationally required; apply application allowlisting and monitor EDR telemetry for Office or Visio processes spawning command shells or scripting engines; deliver targeted phishing awareness to the Visio-installed user population.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB