CVE-2025-54907

HighCVSS 7.8

Published: 09/09/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

42th percentile - higher than 42% of all known CVEs

Summary

Microsoft Office Visio has a heap-based buffer overflow vulnerability. An unauthorized attacker can exploit it to execute code locally.

Risk Assessment

An attacker can execute arbitrary code in the context of a user opening a malicious file, potentially leading to system compromise.

Recommendation

Apply Microsoft security updates for Office Visio. Warn users against opening Visio files from untrusted sources.

Other vulnerabilities in Microsoft Office Visio

See all

CVE-2022-44696High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
CVE-2022-44695High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
CVE-2022-44694High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
CVE-2022-24510High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.
CVE-2022-24509High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
CVE-2022-24461High
A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
CVE-2021-38654High
Remote code execution vulnerability in Microsoft Office Visio. It could allow an attacker to execute code on the victim's system.
CVE-2021-38653High
Remote code execution vulnerability in Microsoft Office Visio. Similar to other Visio flaws, it could allow an attacker to run code.
CVE-2026-102855High
A heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
CVE-2026-102857High
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.

Original NVD description (English source)

Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS