CVE-2026-102856: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-102856 Overview

CVE-2026-102856 is a heap-based buffer overflow [CWE-122] in Microsoft Office Visio that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC on both x86 and x64 platforms. Exploitation requires user interaction, typically opening a crafted Visio file delivered through email, a shared drive, or a web download. Successful exploitation grants the attacker code execution in the context of the current user, enabling follow-on activities such as credential theft, lateral movement, or persistence. Microsoft has published a security advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
A single crafted Visio document can trigger remote code execution with the privileges of the signed-in user across supported Microsoft Office releases.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2021 LTSC (x86 and x64)
Microsoft Office 2024 LTSC (x86 and x64)

Discovery Timeline

2026-10-13 - CVE-2026-102856 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-102856

Vulnerability Analysis

The vulnerability resides in the Visio file parsing logic shipped with Microsoft Office. When Visio processes a malformed diagram structure, it writes past the bounds of a heap-allocated buffer. Attackers can shape the overflow to overwrite adjacent heap metadata, function pointers, or object virtual tables. This control over heap state leads to arbitrary code execution within the Office process.

The attack is network-reachable because Visio files commonly traverse email gateways, SharePoint, OneDrive, and other collaboration channels. The user interaction requirement is low: opening or previewing a weaponized .vsd, .vsdx, or related Visio format is sufficient. Code runs with the privileges of the Office user, which is typically a standard interactive account.

Root Cause

The root cause is improper validation of length or offset fields inside the Visio document structure before copying content into a heap buffer. The parser trusts attacker-controlled size values, allowing a write operation to exceed the allocated region. This classifies as a heap-based buffer overflow under [CWE-122].

Attack Vector

An attacker crafts a malicious Visio document that triggers the overflow during parsing. Delivery methods include phishing email attachments, links to cloud-hosted files, and documents staged on compromised internal shares. When the target opens the file in a vulnerable Office client, the parser processes the malformed structure and the attacker gains code execution. No prior authentication to the target system is required.

Microsoft has not released public exploit details. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is available at the time of publication.

Detection Methods for CVE-2026-102856

Indicators of Compromise

Unexpected child processes spawned by visio.exe, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Visio documents arriving from untrusted senders with embedded objects, oversized stream chunks, or malformed OLE/XML structures.
Office process crashes with heap corruption signatures logged in Windows Error Reporting around Visio file opens.
Outbound network connections from visio.exe to unfamiliar hosts shortly after a document is opened.

Detection Strategies

Hunt for process lineage where visio.exe is the parent of script interpreters or living-off-the-land binaries.
Alert on Office applications writing executable content (.exe, .dll, .ps1) to disk or to %APPDATA% and %TEMP%.
Inspect email attachments and file-share uploads for Visio files that fail schema validation or exceed expected size parameters.
Correlate crash telemetry on VISIO.EXE with subsequent process creation or network activity from the same session.

Monitoring Recommendations

Enable and forward Microsoft Defender for Office 365 Safe Attachments detonation verdicts for Visio file types.
Collect Sysmon Event ID 1 (process creation) and Event ID 11 (file create) events scoped to Office binaries.
Monitor Windows Defender Exploit Guard Attack Surface Reduction rule triggers for Office child-process blocks.

How to Mitigate CVE-2026-102856

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-102856 to all affected Office installations.
Block inbound Visio file types at email gateways from external senders until patching is confirmed enterprise-wide.
Enable Microsoft Defender Attack Surface Reduction rules that prevent Office applications from spawning child processes.
Validate Click-to-Run update channels are current for Microsoft 365 Apps using OfficeC2RClient.exe /update user.

Patch Information

Microsoft has released fixed builds through the standard Office update channels. Administrators should consult the Microsoft Security Update Guide for the exact build numbers applicable to Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC. For LTSC editions, deploy the corresponding Microsoft Update Catalog package through WSUS, Intune, or Configuration Manager.

Workarounds

Open untrusted Visio files only in Protected View, and disable Protected View exit for files originating from the internet or email attachments.
Restrict or remove the Visio Viewer and Visio file handlers on endpoints that do not require Visio functionality.
Train users to report unexpected Visio attachments rather than open them, and quarantine such files for sandbox analysis.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f