Microsoft Office Visio: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in Microsoft Office Visio, part of Microsoft 365 Apps and Office LTSC 2021/2024, allows an unauthorized attacker to execute code over a network. No privileges are required, but a user must interact, for example by opening a malicious Visio file received by email, download or shared drive. The CVSS base score is 8.8 (High).
Affected
- Microsoft 365 Apps for Enterprise (16.0.1 up to the fixed build listed by Microsoft; exact boundary unconfirmed)
- Microsoft Office LTSC 2021: versions before 16.0.14334.20974
- Microsoft Office LTSC 2024: versions before 16.0.17932.21056
- Standalone (MSI) Visio versions: unknown
Fixed in
- Install the current Microsoft 365 Apps and Office LTSC security updates from aka.ms/OfficeSecurityReleases.
- Build numbers from third-party aggregators (for example 16.0.20430.20182 for Current channel) are not confirmed on the MSRC page and must be verified before rollout.
- Office LTSC 2021 support ended on 13 October 2026, so this is its final update.
Workaround
- Official workaround: unknown. Microsoft's advisory was not retrieved with a workaround section.
- Avoid opening unexpected or untrusted Visio files and restrict Visio files from untrusted sources where feasible.
Exploitation
- Microsoft rates exploit code maturity as Unproven (E:U).
- Not listed in CISA KEV; CISA SSVC lists exploitation as none and automatable as no.
- No public proof-of-concept found; EPSS is about 0.6%.
- Real-world exploitation: unknown.
Our recommendation
- Patch Microsoft 365 Apps through the normal update channels as a priority.
- Plan an upgrade for Office LTSC 2021 systems, as they no longer receive updates.
- Verify build numbers against aka.ms/OfficeSecurityReleases before rollout.
- Restrict untrusted Visio files, especially for staff who handle external documents.
- Monitor endpoints for suspicious Office application behaviour.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-102855 msrc.microsoft.com
- Microsoft Security Update Guide advisory: CVE-2026-102855 msrc.microsoft.com
- Vulners: CVE-2026-102855 vulners.com
- VulDB: CVE-2026-102855 vuldb.com
- Action1: October 2026 Patch Tuesday analysis www.action1.com
- Office Watch: October 2026 Office critical fixes office-watch.com
- Strix AI: CVE-2026-102855 www.strix.ai
- Vulners Microsoft CVE mirror: MS:CVE-2026-102855 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:16.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.