CVE-2026-102855 – Microsoft Office Visio Remote Code Execution Vulnerability

Microsoft has identified a Critical Remote Code Execution (RCE) vulnerability in Microsoft Office Visio that could allow an unauthorized attacker to execute malicious code on a vulnerable system. The vulnerability, caused by a heap-based buffer overflow, can be triggered when a user opens a specially crafted Visio file. Successful exploitation could compromise sensitive information, allow unauthorized system modifications, or disrupt business operations. Although Microsoft assesses exploitation as less likely, the vulnerability carries a high security risk because it requires no attacker privileges and has low attack complexity.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability creates a significant security threat to organizations using affected Microsoft Office products.

An attacker could create a malicious Visio file and convince an employee to open it. Once opened, the specially crafted file could trigger a memory corruption vulnerability, potentially allowing the attacker to execute malicious code.

The attack does not require the attacker to have an existing account or elevated privileges on the targeted system.

Successful exploitation could result in:

• Unauthorized Code Execution: Attackers could execute malicious instructions on affected systems.
• Sensitive Data Exposure: Confidential business documents, intellectual property, and other sensitive information could be compromised.
• System Compromise: Attackers could modify files, install malicious software, or interfere with normal system operations.
• Business Disruption: Compromised systems could become unavailable, affecting employee productivity and critical business processes.

The vulnerability is particularly concerning because a single malicious document could become the entry point for a serious security incident.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability was not publicly disclosed before publication, and there are no reported instances of active exploitation.

The exploit code maturity is classified as Unproven, meaning the reported information does not establish the existence of a working public exploit.

There is also no confirmed information about publicly available proof-of-concept (PoC) exploit code or zero-day exploitation.

However, the vulnerability has a low attack complexity, meaning exploitation could be relatively straightforward if an attacker develops a working exploit.

Technical Summary

CVE-2026-102855 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office Visio.

A heap-based buffer overflow occurs when an application writes more data into a memory buffer than the allocated space can safely accommodate.

This can corrupt adjacent memory and potentially allow an attacker to influence application execution.

In this vulnerability, an attacker could exploit the memory handling weakness by creating a specially crafted Visio file.

The attack follows these steps:

1. An attacker prepares a malicious Visio file designed to trigger the heap-based buffer overflow.

2. The attacker distributes the file and attempts to convince a user to open it.

3. When the victim opens the file, the vulnerable application processes the malicious content.

4. The specially crafted content could trigger memory corruption and potentially allow unauthorized code execution.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Although the attack vector is classified as network-based, successful exploitation requires a user to open the malicious file.

The Preview Pane is not an attack vector for this vulnerability.

The vulnerability could compromise confidentiality, integrity, and availability, making successful exploitation potentially damaging to affected systems.

Exploitability

The vulnerability affects Microsoft Office Visio within the following Microsoft Office products:

• Microsoft 365 Apps for Enterprise – 32-bit and 64-bit systems
• Microsoft Office LTSC 2021 – 32-bit and 64-bit editions
• Microsoft Office LTSC 2024 – 32-bit and 64-bit editions

An attacker can attempt exploitation by convincing a user to open a specially crafted Visio file.

No attacker privileges are required, but user interaction is necessary.

Microsoft rates exploitation as Less Likely, and active exploitation has not been reported.

Specific vulnerable build numbers and fixed build numbers are not identified.

Business Impact

This vulnerability presents a serious business risk because commonly used Microsoft Office applications can become an entry point for attackers.

Employees frequently exchange Office documents with customers, suppliers, and external partners. A malicious Visio file disguised as a legitimate business document could expose an organization to unauthorized code execution.

Potential business consequences include:

• Data Breaches: Attackers could gain access to confidential business information, customer records, or intellectual property.
• Operational Disruption: Compromised systems could interrupt business activities and reduce productivity.
• Financial Losses: Security incidents could result in investigation costs, recovery expenses, and operational downtime.
• Reputational Damage: A successful compromise could affect customer confidence and business relationships.
• Further Security Compromise: Malicious code execution could provide attackers with an opportunity to conduct additional malicious activities.

Organizations that regularly exchange Visio diagrams, technical documentation, or business process files may face increased exposure to malicious documents.

“A trusted-looking document can become an attacker’s doorway into the business. One successful exploit could turn a routine file-opening action into a costly security incident.”

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

If immediate patch deployment is not possible, organizations should consider the following precautionary measures:

• Avoid opening unexpected or untrusted Visio files.
• Educate employees about malicious attachments and suspicious document-sharing requests.
• Restrict access to Visio files from untrusted sources where operationally feasible.
• Use endpoint security monitoring to detect suspicious application behavior.

These precautions may reduce exposure but do not eliminate the underlying vulnerability.

Urgency

Critical – Prioritize Patch Deployment

CVE-2026-102855 should be prioritized for remediation because it carries a Critical severity rating and a CVSS score of 8.8.

The vulnerability could allow remote code execution without requiring attacker privileges.

Although Microsoft currently considers exploitation less likely and has not reported active exploitation, the combination of low attack complexity and potentially severe consequences makes this an important security concern.

Organizations should prioritize deploying the official Microsoft security fix across affected Microsoft 365 Apps for Enterprise and Office LTSC installations.

Security teams should also identify vulnerable installations, verify successful patch deployment, and monitor systems for suspicious Visio-related activity.

“Attackers only need one successful opening of a malicious file. Patching early can prevent a simple document attack from becoming a major business disruption.”