CVE-2011-0092: The LZW stream decompression functionality in ORMELEMS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007...

Security readout for executives and security teams

This is an old Microsoft Visio remote code execution issue. A specially malformed Visio file can corrupt memory during LZW stream decompression, potentially letting an attacker run code when a user opens the file. Business risk mainly remains where legacy Visio 2002, 2003, or 2007 installations still exist. Exposure is limited to environments still running the named legacy Visio versions or opening Visio documents with vulnerable components installed. Modern systems are only in scope if they retain those affected versions or equivalent unpatched deployments. Treat as high priority only if legacy Visio is present. The vulnerability enables code execution through a document, but the affected products are very old and exposure should be sharply bounded by asset inventory. Mitigation focus: Review and apply Microsoft MS11-008 guidance for affected Visio installations.; Retire, upgrade, or isolate legacy Visio 2002, 2003, and 2007 deployments.; Restrict handling of untrusted Visio files where affected software remains..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.