Microsoft Office Visio RCE (CVE-2026-102857): Patch and restrict untrusted Visio files

Microsoft has published CVE-2026-102857 for a remote code execution vulnerability in Microsoft Office Visio. The issue is described as a heap-based buffer overflow that an unauthorized attacker can exploit over a network. The available advisory does not specify affected versions, exploit status, or required prerequisites, so treat it as a high-priority Office application risk until patching and monitoring are complete.

What happened

A heap-based buffer overflow in Visio can lead to code execution when an attacker delivers a crafted file or otherwise triggers the vulnerable code path. Because the vulnerability is network-reachable, it can be relevant to phishing, malicious document sharing, and web-to-file attack chains.

Impact

• Remote code execution in the context of the user opening or processing a malicious Visio file.
• Potential lateral movement if compromised accounts have access to internal systems.
• Increased risk for endpoints that routinely open Visio files from email, shared drives, or untrusted web portals.

What to do

• Apply the Microsoft security update for CVE-2026-102857 through Windows Update, Microsoft Endpoint Configuration Manager, Intune, or your patch management process.
• Inventory endpoints with Microsoft Office Visio installed and prioritize production, privileged, and externally exposed systems.
• Restrict or monitor Office file handling: block macros, limit Office file types from untrusted sources, and enforce safe attachment policies in email and collaboration tools.
• Review logs for Visio process creation, child processes, unusual network connections, and Office-related file drops.
• If patching is delayed, consider application allowlisting, endpoint isolation, or disabling Visio for users who do not require it.

Until Microsoft provides version and exploit details, treat untrusted Visio files as potentially malicious and verify that the CVE fix is deployed across all affected Office installations.