CVE-2010-0260

CWE-94 — Code Injection4 documents4 sources
Severity
9.3CRITICAL
EPSS
57.6%
top 1.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft ExcelMicrosoft OfficeMicrosoft Office Compatibility Pack+1 more
Timeline
PublishedMar 10
Latest updateMay 2

Description

Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a MDXTUPLE record is broken up into several records," aka "Microsoft Office Excel MDXTUPLE Record Heap Overflow Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmicrosoft/excel2002, 2003, 2007+2
▶NVDmicrosoft/office2004, 2008+1

🔴Vulnerability Details

2
GHSA
GHSA-wc72-922g-4fvx: Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel,↗2022-05-02
▶
CVEList
CVE-2010-0260: Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel,↗2010-03-10
▶

💥Exploits & PoCs

1
Exploit-DB
CA BrightStor Discovery Service - Remote Stack Buffer Overflow (Metasploit)↗2010-05-09
▶