Microsoft Visio EUVD-2026-99039

Exploitation requires a victim to open an attacker-supplied, specially crafted Visio file (UI:R in the CVSS vector) - the attack is not zero-click and depends on social engineering to deliver and have the malicious document opened, typically via email attachment or download link. No authentication is required of the attacker (PR:N) and no special target-side configuration is indicated; standard Microsoft Office Visio handling the malformed file is sufficient. Code executes in the context of the user who opens the file, so a low-privileged user account limits the immediate blast radius absent further privilege escalation. The requirement for user interaction and the need for Visio to be installed and used to open the file are the principal limiting factors on real-world exploitation.

This is a genuine high-priority vulnerability, though not a top-tier emergency based on available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw whose single mitigating factor is required user interaction (UI:R) - consistent with the classic Office client-side attack pattern of enticing a victim to open a malicious Visio document. Key exploitation-prioritization signals are MISSING from the input: no EPSS probability was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The sole reference is the vendor MSRC advisory with no NVD enrichment, meaning EPSS/KEV absence reflects incomplete input data rather than a confirmed low-risk determination. Net: treat as a priority patch due to CRITICAL technical impact (full C/I/A) on a widely deployed Office component and the recurring real-world exploitation of Office file-parsing flaws, while recognizing that the UI:R requirement and the lack of any confirmed exploitation or POC evidence lower the immediate mass-exploitation likelihood relative to a zero-click network flaw.

An attacker crafts a malicious Visio file that triggers a heap-based buffer overflow in Microsoft Office Visio's parsing code and delivers it via email or a web link. When a targeted user opens the file, the overflow corrupts heap memory and the attacker achieves arbitrary code execution in the user's security context. No public exploit code was identified at time of analysis.