CVE-2026-102857

Summary

A heap-based buffer overflow in Microsoft Office Visio allows remote code execution when a user opens a specially crafted Visio file over a network. This vulnerability affects multiple Microsoft Office versions including Visio, Office 2021, and Office 2024, making it particularly dangerous for enterprise environments where users frequently open files from shared locations or email attachments.

Exploitability

Exploitation is moderately difficult as it requires an attacker to convince a user to open a malicious Visio file over a network, but once triggered, the vulnerability allows full remote code execution with the privileges of the affected user.

Blast radius

The impact could be significant in enterprise environments where Visio files are commonly shared and opened from network locations, potentially allowing attackers to gain full system access on multiple machines across the organization.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy the Microsoft Office Visio update KB5041038 or later, which contains the patch for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.