CVE-2010-3333
KEVMicrosoft Office Stack-based Buffer Overflow Vulnerability
Description
A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HPublishedNov 10, 2010
Last modifiedJun 16, 2026
Added to KEVMar 3, 2022
Remediation dueMar 24, 2022
References
- labs.idefense.com/intelligence/vulnerabilities/display.php?id=880Broken Link
- secunia.com/advisories/38521Broken Link
- secunia.com/advisories/42144Broken Link
- securityreason.com/securityalert/8293Broken Link
- securityfocus.com/bid/44652Broken LinkThird Party Advisory
- securitytracker.com/id?1024705Broken LinkThird Party Advisory
- us-cert.gov/cas/techalerts/TA10-313A.htmlThird Party AdvisoryUS Government Resource
- vupen.com/english/advisories/2010/2923Broken Link
- docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087PatchVendor Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931Broken Link
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3333US Government Resource
0 recent articles mention this CVE
78
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1677 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 89.4% · top 1% of all CVEs
- Weakness
- CWE-787
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.