Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-0105 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Excel

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-805 — Buffer Access with Incorrect Length Value9 documents9 sources
Severity
9.3CRITICALNVD
EPSS
89.4%
top 0.45%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Microsoft ExcelMicrosoft Office
Timeline
PublishedApr 13
Latest updateMay 14

Description

Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized memory location, which allows remote attackers to trigger a buffer overflow and execute arbitrary code via a crafted Excel file, aka "Excel Data Initialization Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDmicrosoft/excel2002
▶NVDmicrosoft/office2004, 2008+1

🔴Vulnerability Details

3
GHSA
GHSA-rpg9-x63j-3644: Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized↗2022-05-14
▶
CVEList
CVE-2011-0105: Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized↗2011-04-13
▶
VulnCheck
Microsoft Excel Improper Restriction of Operations within the Bounds of a Memory Buffer↗2011
▶

💥Exploits & PoCs

2
Exploit-DB
Microsoft Excel 2007 - '.xlb' Local Buffer Overflow (MS11-021) (Metasploit)↗2011-11-05
▶
Metasploit
MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow↗
▶

🕵️Threat Intelligence

1
Zscaler
Zscaler found Multiple Security Vulnerabilities | 04-12-2011↗
▶

📐Framework References

1
CWE
Buffer Access with Incorrect Length Value↗
▶

💬Community

1
Bugzilla
CVE-2011-2262 mysql: Unspecified vulnerability allows remote attackers to affect availability↗2012-01-22
▶
CVE-2011-0105 — Microsoft Excel vulnerability | cvebase