CVE-2026-102857: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-102857 Overview

CVE-2026-102857 is a heap-based buffer overflow [CWE-122] in Microsoft Office Visio that enables remote code execution. An unauthenticated attacker can execute arbitrary code on a target system when a user opens a crafted Visio file. The vulnerability affects Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 across both x86 and x64 editions. Exploitation requires user interaction, typically opening a malicious document delivered through email or a web download. Microsoft published the advisory on October 13, 2026, and tracks the issue through the Microsoft Security Response Center.

Critical Impact
Successful exploitation grants attackers code execution in the context of the current user, enabling malware deployment, credential theft, and lateral movement across the environment.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office LTSC 2021 (x86 and x64)
Microsoft Office LTSC 2024 (x86 and x64)

Discovery Timeline

2026-10-13 - CVE-2026-102857 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-102857

Vulnerability Analysis

The flaw resides in Microsoft Office Visio's parsing of document file structures. A heap-based buffer overflow occurs when Visio processes malformed data in a crafted file, writing beyond the bounds of an allocated heap buffer. Attackers craft Visio documents containing malicious structures that trigger the overflow during document loading.

Successful exploitation delivers remote code execution in the context of the current user. If the user holds administrative rights, the attacker gains full control over the host. Office exploits of this class typically bypass Protected View when users click "Enable Editing" or when the file originates from a trusted location.

The vulnerability is network-reachable because Visio documents commonly transit email, SharePoint, and web downloads. User interaction is required: the victim must open the attacker-supplied file.

Root Cause

The root cause is improper validation of input length or structure during heap allocation in Visio file parsing. The parser copies attacker-controlled data into a heap buffer without verifying that the data fits within the allocated region. This classic [CWE-122] pattern corrupts adjacent heap metadata or object pointers, which attackers leverage to redirect execution flow.

Attack Vector

Attackers deliver a weaponized .vsd, .vsdx, or related Visio file via phishing email, malicious URL, or shared file service. When the target opens the file in a vulnerable Visio build, the parser processes the malformed object and overflows the heap buffer, resulting in code execution. See the Microsoft Vulnerability CVE-2026-102857 advisory for vendor technical details.

Detection Methods for CVE-2026-102857

Indicators of Compromise

Unexpected child processes spawned by visio.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Visio documents arriving from external senders, especially files with Mark-of-the-Web attributes that users override.
Outbound network connections initiated by visio.exe to uncommon domains or IP addresses shortly after document open.
Writes to persistence locations (Run keys, Startup folders, Scheduled Tasks) immediately following Visio file activity.

Detection Strategies

Hunt for process trees where visio.exe is the parent of script interpreters or living-off-the-land binaries.
Monitor Office telemetry for crashes or exceptions in Visio processes that may indicate exploitation attempts.
Inspect email gateways and web proxies for Visio file formats inbound from untrusted sources and apply attachment sandboxing.
Correlate Visio file opens with subsequent credential access or discovery behaviors on the same host.

Monitoring Recommendations

Enable Microsoft Defender for Office 365 Safe Attachments and detonation for Visio file types.
Forward Sysmon process creation, image load, and network connection events to a central SIEM for behavioral analysis.
Alert on new or unsigned DLLs loaded by visio.exe from user-writable paths.

How to Mitigate CVE-2026-102857

Immediate Actions Required

Deploy the Microsoft October 2026 security update for Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 as soon as possible.
Prioritize patching for users who routinely receive Visio documents from external parties.
Enforce Protected View for files originating from the internet and restrict users from bypassing it.
Block or quarantine Visio file formats at the email gateway for high-risk user groups until patching completes.

Patch Information

Microsoft released a security update addressing CVE-2026-102857 through the standard Microsoft Update channel. Refer to the Microsoft Security Response Center advisory for build numbers and KB identifiers specific to each affected product. Click-to-Run installations of Microsoft 365 Apps receive updates automatically when connected to the update service.

Workarounds

Configure Office File Block policy to prevent opening legacy Visio file formats from untrusted locations.
Enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes.
Restrict Visio file execution to users with a documented business need and remove the client from systems that do not require it.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Office applications from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled