Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-0978

CWE-119 — Buffer Overflow4 documents4 sources

Severity

9.3CRITICAL

EPSS

75.9%

top 1.09%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Microsoft Excel Microsoft Office Microsoft Office Compatibility Pack

Timeline

PublishedFeb 10

Latest updateMay 14

Description

Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via vectors related to an axis properties record, and improper incrementing of an array index, aka "Excel Array Indexing Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDmicrosoft/excel2002, 2003, 2007+2

▶NVDmicrosoft/office_compatibility_pack2007

▶NVDmicrosoft/office2004

🔴Vulnerability Details

GHSA

GHSA-693v-vh3p-cg3g: Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack↗2022-05-14

▶

CVEList

CVE-2011-0978: Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack↗2011-02-10

▶

💥Exploits & PoCs

Exploit-DB

Microsoft Excel - Axis Properties Record Parsing Buffer Overflow (PoC) (MS11-02)↗2011-04-29

▶