CVE-2011-1972

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.3CRITICAL
EPSS
57.9%
top 1.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Visio
Timeline
PublishedAug 10
Latest updateMay 14

Description

Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote attackers to execute arbitrary code via a crafted file, aka "pStream Release RCE Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/visio2003, 2007, 2010+2

🔴Vulnerability Details

2
GHSA
GHSA-4h8m-v678-p6jw: Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote↗2022-05-14
▶
CVEList
CVE-2011-1972: Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote↗2011-08-10
▶
CVE-2011-1972 (CRITICAL CVSS 9.3) | Microsoft Visio 2003 SP3 | cvebase.io