CVE-2010-0257

CWE-94 — Code Injection3 documents3 sources

Severity

9.3CRITICAL

EPSS

58.3%

top 1.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Excel Microsoft Office Microsoft Office Compatibility Pack +1 more

Timeline

PublishedMar 10

Latest updateMay 2

Description

Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel Record Memory Corruption Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmicrosoft/excel2002, 2003, 2007+2

▶NVDmicrosoft/office2004, 2008+1

▶NVDmicrosoft/office_sharepoint_server2007

▶NVDmicrosoft/office_compatibility_pack2007

🔴Vulnerability Details

GHSA

GHSA-6gv9-w2gh-cw82: Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted s↗2022-05-02

▶

CVEList

CVE-2010-0257: Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted s↗2010-03-10

▶