CVE-2026-102856: Heap buffer overflow RCE in Microsoft Office Visio · ZeroHour

CVE-2026-102856

mass

Heap buffer overflow RCE in Microsoft Office Visio

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-102856 is a heap-based buffer overflow (CWE-122), also tied to an integer overflow (CWE-190), in Microsoft Office Visio. An unauthorized attacker on the network can trigger it if a user opens crafted Visio content; no prior privileges are required, but user interaction is. Successful exploitation yields remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Microsoft Office Visio users are affected; exact version ranges are not listed in the source data and the issue is associated with the October 2026 security updates. It is not on CISA’s Known Exploited Vulnerabilities list and no public proof-of-concept is known.

What to do: Install the October 2026 Microsoft security updates for Office Visio as soon as they are available for your channel. Until patched, do not open Visio files or diagrams from untrusted sources, and treat unexpected Visio attachments as suspicious because exploitation requires a user to open crafted content.

Affected

Microsoft Office Visio

—

Estimated exposure

massMillions of Visio installations worldwide (estimate) — Microsoft Visio is a widely deployed paid diagramming app in Microsoft 365 and Office enterprise environments; public install counts are not available, so the figure is an order-of-magnitude estimate rather than a measured census.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: 365 apps, office 2021, office 2024
Weakness: CWE-122, CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102856

In the news1 stories

The October 2026 Security Update Review