cbcvebase.
CVE-2010-1246
published 2010-06-08

CVE-2010-1246: Stack-based buffer overflow in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD (0x813)…

PriorityP260critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
24.67%
97.7th percentile
Stack-based buffer overflow in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD (0x813) record, aka "Excel RTD Memory Corruption Vulnerability."

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftexcel——

Detection & IOCsextracted from sources · hover to see the quote

bytes↗
\x41\x41\x41 (padding) + jmp + eggHunter + \xeb\x06\x41\x41 + eip + \x81\xc4\x24\x16\x00\x00 + \xc3
  • →Target file type is a malformed XLS (Excel 97-2003 Binary Format) containing a malformed RTD record (record type 0x813). Detection should focus on XLS files with anomalous RTD record structure triggering a stack-based buffer overflow. ↗
  • →The exploit payload uses an egg-hunter technique combined with a stack pivot (ADD ESP, 0x1624 / RET) to redirect execution. Look for the byte sequence \x81\xc4\x24\x16\x00\x00\xc3 in memory or file content as a stack-pivot indicator. ↗
  • →The exploit writes 54 repetitions of \x41\x41\x41\x41 as padding after the RET gadget, producing a 216-byte NOP-sled-like block of 0x41 bytes. This pattern in an XLS file is a strong indicator of exploitation. ↗
  • →The exploit embeds a short-jump stub \xeb\x06\x41\x41 immediately before the overwritten EIP value. Scanning for this 4-byte sequence adjacent to a return address in XLS BIFF records may identify exploit attempts. ↗
  • ·The exploit targets specifically Microsoft Office Excel 2002 SP3; other Excel versions are not listed as affected by this CVE. ↗
  • ·The exploit enforces a maximum shellcode length of 800 bytes and a maximum egg-hunter length of 266 bytes; payloads exceeding these limits are rejected by the PoC generator. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.