CVE-2026-102855 — Microsoft Office Visio Remote Code Execution Vulnerability

Wed, 11 Nov 2026 00:00:00 +0000

Summary

A heap-based buffer overflow vulnerability in Microsoft Office Visio allows an unauthenticated attacker to achieve remote code execution by convincing a victim to open a specially crafted file. The Preview Pane is not an attack vector; the victim must explicitly open the malicious document.

Microsoft rates this vulnerability as Critical with a CVSS 3.1 base score of 8.8, though exploitation is assessed as “Less Likely.”

This vulnerability was discovered by Aretiq AI and responsibly disclosed to Microsoft, who addressed it in the October 2026 Patch Tuesday security updates. Microsoft has credited ECooper with Aretiq.AI for reporting this vulnerability in their security advisory.

Heap-Buffer-Overflow on Aretiq AI

CVE-2026-102855 — Microsoft Office Visio Remote Code Execution Vulnerability

Summary