Key points
- CVE-2026-102857 is a high-severity remote code execution flaw in Microsoft Office Visio.
- The vulnerability involves a heap-based buffer overflow that attackers can exploit over a network.
- Patches are available for Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.
Microsoft has released security updates to address a high-severity remote code execution vulnerability in Office Visio. The flaw, identified as CVE-2026-102857, affects multiple versions of the diagramming software. According to the National Vulnerability Database, the issue carries a CVSS score of 8.8. This rating places the vulnerability in the high severity category. Organizations using affected versions must apply the latest patches to protect their systems from unauthorized network attacks.
In plain English
A heap-based buffer overflow occurs when a program writes more data to a memory block than it can hold. In this case, the flaw exists within Microsoft Office Visio. An attacker can exploit this weakness over a network without needing user credentials. This allows them to execute arbitrary code on the affected machine. The source material states that an unauthorized attacker can execute code over a network. It does not specify whether a victim must open a file or if the attack is fully unauthenticated beyond the network vector.
The background
The affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Specifically, versions of Office LTSC 2021 prior to 16.0.14334.20974 are vulnerable. Similarly, Office LTSC 2024 versions before 16.0.17932.21056 are at risk. Microsoft 365 Apps for Enterprise users should update to the latest release available via the Office Security Releases channel. The National Vulnerability Database lists CWE-122 and CWE-193 as the underlying weakness classes.
Who needs to act first
Teams usually prioritize systems that face the internet or handle sensitive diagrams. Check whether your Visio installations are on public-facing servers or workstations with direct network access. Test the update in a non-production environment first to ensure compatibility with existing templates and macros. Back up critical diagram files before applying the patch. If you cannot update immediately, restrict network access to Visio services where possible. Monitor logs for unusual activity that might indicate exploitation attempts while waiting for the fix.
What to do and how to stay safe: Microsoft
- Verify which version of Office Visio is installed on all company workstations and servers.
- Apply the latest security update provided by Microsoft to all affected systems.
- Monitor network traffic for signs of unauthorized access attempts targeting Visio services.
- Ensure that only trusted users have access to systems running vulnerable versions of the software.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102857?
It is a heap-based buffer overflow vulnerability in Microsoft Office Visio that allows remote code execution.
Which Office versions are affected?
Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, and Office LTSC 2024 before 16.0.17932.21056.
Is there a fix available?
Yes, Microsoft has released security updates for all affected versions of Office Visio.
