A heap‑based buffer overflow exists in Microsoft Office Visio that permits an attacker to execute arbitrary code in the context of the Office application. The flaw can be triggered by an unauthenticated attacker who crafts a malicious file and delivers it over the network to an affected system, giving the attacker full control over the victim’s workstation.

The vulnerability affects Office products bundled with Microsoft 365 Apps for Enterprise as well as the long‑term servicing channel releases Office LTSC 2021 and Office LTSC 2024. Version details beyond the product line are not specified in the data.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available, meaning up‑to‑date exploitation probability data is lacking. The vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit it remotely through a network connection, especially when Visio files are received from untrusted sources. Successful exploitation would give the attacker complete code execution privileges on the affected machine.