Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2026-102855) – Immediate Patch Required

What happened

A heap-based buffer overflow in Microsoft Office Visio (all versions) allows an attacker to trigger remote code execution by sending a specially crafted Visio file over a network connection. The vulnerability is exploitable without user interaction, enabling attackers to run arbitrary code with the privileges of the user running Visio.

Impact

Systems with Visio installed and exposed to untrusted networks are at risk. Successful exploitation can lead to full system compromise, lateral movement, and persistence.

Mitigation

• Apply the latest Microsoft security update for Office Visio (CVE-2026-102855).
• Verify that all Visio installations are updated to the latest patch level.
• Restrict network access to Visio services using firewall rules or network segmentation.
• Enable application whitelisting to prevent execution of untrusted Visio files.

What to do

SecOps teams should:

• Run a quick inventory scan to identify all machines with Visio installed.
• Deploy the update via WSUS, SCCM, or other patch management tools.
• Monitor event logs for suspicious Visio activity (e.g., unexpected process creation).
• Implement network monitoring to detect anomalous traffic to/from Visio ports.