Microsoft Office Visio: Remote code execution via heap buffer overflow
Summary
Microsoft's CVE record describes a heap-based buffer overflow in Microsoft Office Visio that allows code execution over a network. The record lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and LTSC 2024 as affected products, so every Office installation should be checked. An attacker could run code without privileges, but user interaction is required, typically by getting a user to open a crafted document. Microsoft rates the vulnerability CVSS 3.1 8.8 (High).
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (see the link in the CVE record)
- Office LTSC 2021: 16.0.1 before 16.0.14334.21048
- Office LTSC 2024: 16.0.0 before 16.0.17932.21140
- Visio: not listed separately; check standalone Visio installations
Fixed in
- Office LTSC 2021: 16.0.14334.21048 or later
- Office LTSC 2024: 16.0.17932.21140 or later
- Microsoft 365 Apps for Enterprise: fixed build not stated in the sources; see the Office security release page linked in the CVE record
Workaround
Unknown. No workaround is documented in the sources.
- Until patched, block or quarantine untrusted Office and Visio files at the mail gateway (general measure, not from the vendor)
Exploitation
- No known exploitation in the wild, as far as could be found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- CVSS temporal metrics E:U (exploit maturity unproven) and RC:C (report confirmed).
- No public proof of concept found.
Our recommendation
- Install the Microsoft 365 and Office updates as soon as possible; Microsoft 365 Apps are usually updated centrally.
- Check every installation, including standalone Visio, against the fixed builds.
- Block or quarantine untrusted Office and Visio attachments at the mail gateway until patched.
- Monitor for exploitation and recheck the CISA KEV catalog over the coming days.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-109494 msrc.microsoft.com
- CVE Record CVE-2026-109494 (CVE.org) www.cve.org
- GitHub CVE tracker issue 4035 (KEV status) github.com
- Nessus plugin: Microsoft Visio Click-to-Run updates October 2026 (related CVEs) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:54.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.