Advisory · CVE-2026-102857
Heap-based buffer overflow in Microsoft Office Visio can run code from a crafted file
Microsoft Office Visio has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Office Visio
- Identifier / CWE
- CVE-2026-102857
CWE-122, CWE-193 - Action timing
- Immediate
Explain it like I’m five
Second Visio heap overflow this cycle, in the same file-handling family as its sibling flaw.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Microsoft Office Visio.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-102857 in its October 2026 update guide: a heap-based buffer overflow weakness (CWE-122) in Microsoft Office Visio that lets a remote attacker execute code through a crafted file. Microsoft’s affected data covers the Microsoft 365 Apps and Office LTSC release lines.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Microsoft Office Visio deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft Office Visio while remediation is underway, especially for internet-facing instances.
- Review application and server logs for Visio crashes tied to newly received diagram files.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Crafted Visio files are a delivery staple. Push the Office updates with the OS set and treat crash clusters as a hunting lead.