CVE-2010-0263

CWE-94 — Code Injection3 documents3 sources
Severity
9.3CRITICAL
EPSS
54.9%
top 1.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft ExcelMicrosoft OfficeMicrosoft Office Compatibility Pack+1 more
Timeline
PublishedMar 10
Latest updateMay 2

Description

Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers during decompression of Open XML (.XLSX) documents, which allows remote attackers to execute arbitrary code via a crafted document that triggers access to uninitialized memory locations, aka "Microsoft …

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmicrosoft/office2004, 2008+1
▶NVDmicrosoft/excel2002, 2003, 2007+2

🔴Vulnerability Details

2
GHSA
GHSA-fjp3-x79g-grgm: Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatib↗2022-05-02
▶
CVEList
CVE-2010-0263: Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatib↗2010-03-10
▶
CVE-2010-0263 (CRITICAL CVSS 9.3) | Microsoft Office Excel 2007 SP1 and | cvebase.io