{"id":"CVE-2026-109494","kind":"vulnerability","aliases":["CVE-2026-109494"],"related":[],"title":"Microsoft Office Visio: heap overflow lets a network attacker run code","description":"Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Office Visio lets an unauthorized attacker trigger memory corruption over a network. The sources say the attacker can execute code on the affected machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","other","visio","windows"],"not_affected_if":["visio-not-installed"],"how_to_check":"- Open Visio and check the version under File > Account (Microsoft 365) or Help > About Visio, then compare against the fixed builds in the vendor advisory.\n- Confirm whether Microsoft Office updates are installed through Windows Update or Microsoft AutoUpdate.","fix":null,"status":"open","published_at":"2026-11-10T19:18:18+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","triaged_at":"2026-11-10T19:33:57+00:00","updated_at":"2026-11-10T19:33:57+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:33:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Office Visio: heap overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Visio lets an unauthorized attacker trigger memory corruption over a network. The sources say the attacker can execute code on the affected machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","visio","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Visio machine over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-109494 for affected builds, fixed versions, and whether a file must be opened.","how_to_check":"- Open Visio and check the version under File > Account (Microsoft 365) or Help > About Visio, then compare against the fixed builds in the vendor advisory.\n- Confirm whether Microsoft Office updates are installed through Windows Update or Microsoft AutoUpdate.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["visio-not-installed"],"who_is_affected":"Organizations running Microsoft Office Visio on Windows. The sources do not state the affected build ranges, the required user interaction, or any special configuration, so the exposure window is unknown. Systems without Visio installed are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4496,"output_tokens":527,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-109494 for affected builds, fixed versions, and whether a file must be opened.","search":"'-109494':14A,17A '-2026':13A,16A 'affect':54B 'allow':65C 'attack':9A,37B,48B,68C 'base':27B,58C 'buffer':28B,59C 'code':11A,51B,71C 'corrupt':40B 'cve':12A,15A 'execut':50B,70C 'heap':4A,26B,57C 'heap-bas':25B,56C 'let':6A,34B 'machin':55B 'memori':39B 'microsoft':1A,19B,31B,62C 'microsoft-offic':18B 'network':8A,43B,74C 'offic':2A,20B,32B,63C 'overflow':5A,29B,60C 'run':10A 'say':46B 'sourc':45B 'trigger':38B 'unauthor':36B,67C 'visio':3A,22B,33B,64C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft Office Visio on Windows. The sources do not state the affected build ranges, the required user interaction, or any special configuration, so the exposure window is unknown. Systems without Visio installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","other","visio","windows"],"campaign_type":null,"search_a":"'-109494':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'heap':4A 'let':6A 'microsoft':1A 'network':8A 'offic':2A 'overflow':5A 'run':10A 'visio':3A","search_b":"'affect':54B 'attack':37B,48B 'base':27B 'buffer':28B 'code':51B 'corrupt':40B 'execut':50B 'heap':26B 'heap-bas':25B 'let':34B 'machin':55B 'memori':39B 'microsoft':19B,31B 'microsoft-offic':18B 'network':43B 'offic':20B,32B 'overflow':29B 'say':46B 'sourc':45B 'trigger':38B 'unauthor':36B 'visio':22B,33B 'window':23B","search_c":"'allow':65C 'attack':68C 'base':58C 'buffer':59C 'code':71C 'execut':70C 'heap':57C 'heap-bas':56C 'microsoft':62C 'network':74C 'offic':63C 'overflow':60C 'unauthor':67C 'visio':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109494","severity":null,"published_at":"2026-11-10T19:18:18+00:00","modified_at":"2026-11-10T19:18:18+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","fetched_at":"2026-11-10T19:24:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}