Summary
A heap-based buffer overflow vulnerability in Microsoft Office Visio allows an unauthenticated attacker to achieve remote code execution by convincing a victim to open a specially crafted file. The Preview Pane is not an attack vector; the victim must explicitly open the malicious document.
Microsoft rates this vulnerability as Critical with a CVSS 3.1 base score of 8.8, though exploitation is assessed as “Less Likely.”
This vulnerability was discovered by Aretiq AI and responsibly disclosed to Microsoft, who addressed it in the October 2026 Patch Tuesday security updates. Microsoft has credited ECooper with Aretiq.AI for reporting this vulnerability in their security advisory.
Affected Versions
| Product | Fixed Build | Update |
|---|---|---|
| Microsoft 365 Apps for Enterprise (32-bit, 64-bit) | See release notes | Office Security Updates |
| Microsoft Office LTSC 2021 (32-bit, 64-bit) | 16.0.14334.20974 | Office Security Updates |
| Microsoft Office LTSC 2024 (32-bit, 64-bit) | 16.0.17932.21056 | Office Security Updates |
Remediation
Apply the latest Office security update for your product version. Microsoft 365 Apps receive the fix through automatic updates; LTSC editions require manual patching.
Timeline
| Date | Event |
|---|---|
| 2026-09-21 | Vulnerability discovered |
| 2026-09-23 | Vulnerability reported to Microsoft |
| 2026-09-23 | Microsoft acknowledges case |
| 2026-10-13 | Microsoft releases security update (October 2026 Patch Tuesday) |
| 2026-11-11 | Advisory published |