{"id":"CVE-2026-102857","published":"2026-10-13T19:17:50.097","lastModified":"2026-10-15T17:28:58.637","description":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-122","CWE-193"],"vendors":["microsoft"],"products":["365 apps","office 2021","office 2024"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102857","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Microsoft Office Visio allows remote code execution when a user opens a specially crafted Visio file over a network. This vulnerability affects multiple Microsoft Office versions including Visio, Office 2021, and Office 2024, making it particularly dangerous for enterprise environments where users frequently open files from shared locations or email attachments.","exploitability":"Exploitation is moderately difficult as it requires an attacker to convince a user to open a malicious Visio file over a network, but once triggered, the vulnerability allows full remote code execution with the privileges of the affected user.","blast_radius":"The impact could be significant in enterprise environments where Visio files are commonly shared and opened from network locations, potentially allowing attackers to gain full system access on multiple machines across the organization.","remediation":"Deploy the Microsoft Office Visio update KB5041038 or later, which contains the patch for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","office","network","buffer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:52:34.182Z"}}