Microsoft Office Visio Heap Overflow CVE-2026-102857 Enables Network Remote Code Execution
A high-severity heap-based buffer overflow in Visio allows an unauthorised attacker to execute code over a network on unpatched systems.
Key points
- Microsoft rates CVE-2026-102857 as HIGH severity with a CVSS score of 8.8.
- The flaw is a heap-based buffer overflow in Microsoft Office Visio.
- Affected products include Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 editions.
Microsoft has published a security advisory for CVE-2026-102857, a remote code execution vulnerability in Microsoft Office Visio. According to the Microsoft Security Update Guide, this heap-based buffer overflow allows an unauthorised attacker to execute code over a network. The flaw affects several current versions of the application, requiring immediate attention for enterprises using these specific builds.
Root cause
The vulnerability is classified as a heap-based buffer overflow within the Visio application. The NVD record lists the associated weaknesses as CWE-122 and CWE-193. These identifiers correspond to general classes of memory safety errors. The source material does not provide specific technical details regarding the exact code path or input processing logic that triggers the overflow in this particular instance.
Attack path
An attacker can exploit this vulnerability remotely over a network. The advisory states that an unauthorised attacker can execute code. This remote vector allows threat actors to target systems running the vulnerable versions of Visio that are accessible over the network. The source material does not specify whether the attack requires user interaction or specific file types, only that the execution occurs over a network.
Affected versions
The following versions are confirmed affected:
- Microsoft 365 Apps for Enterprise (before the latest security releases)
- Microsoft Office LTSC 2021 (before version 16.0.14334.20974)
- Microsoft Office LTSC 2024 (before version 16.0.17932.21056)
Mitigation
- Apply the latest security updates provided by Microsoft for all affected Visio versions.
- Ensure Microsoft 365 Apps for Enterprise are updated to the most recent release.
- Verify that Office LTSC 2021 and 2024 installations meet the minimum version requirements listed in the advisory.
Signals worth monitoring
Security teams should monitor for unusual outbound connections from Visio processes, which may indicate command-and-control activity. Look for unexpected memory allocation errors or crashes within the application logs, as these can signal exploitation attempts. Check for new services or scheduled tasks created by the Visio executable, a common persistence technique. Teams usually isolate affected endpoints immediately upon detection to prevent lateral movement while investigating the scope of the compromise.
What to do and how to stay safe: Microsoft
- Patch all vulnerable Visio installations to the latest recommended versions.
- Restrict network access to Visio services to limit exposure to untrusted networks.
- Monitor process creation logs for child processes spawned by Visio.
- Validate file integrity for Visio binaries to detect tampering.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102857?
The NVD rates the vulnerability as HIGH with a CVSS score of 8.8.
Which Office versions are not affected?
Only versions of Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 that are updated to or beyond the specified minimum builds are considered fixed.
Is authentication required to exploit this flaw?
The advisory states an unauthorised attacker can execute code over a network.
