CVE-2026-102855
8.8HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Remote attackers can execute arbitrary code with the user's privileges if a user opens a malicious Visio file. Exploitation requires user interaction to open the file.
Root cause
A heap-based buffer overflow flaw exists in Microsoft Office Visio when parsing crafted input files.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the latest security update for Microsoft Visio from the Microsoft Security Update Guide. As an interim workaround, block or warn users against opening untrusted Visio files received over email or downloaded from the web.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.