CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability

CVE-2010-3333 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2022-03-03

A stack-based buffer overflow vulnerability in Microsoft Office allows remote attackers to execute arbitrary code via crafted RTF (Rich Text Format) data. The flaw exists in the parsing of RTF data across multiple versions of Office for Windows and Mac.

Technologies: Microsoft Office. Vendors: Microsoft.

Quick answers

Is CVE-2010-3333 exploited in the wild?
Yes. CVE-2010-3333 is known to be exploited in the wild, first recorded on 3 March 2022. Treat it as urgent.
How severe is CVE-2010-3333?
Critical severity, with a CVSS score of 9.3, published 3 March 2022.
Which products and versions are affected?
Microsoft Office XP SP3; Microsoft Office 2003 SP3; Microsoft Office 2007 SP2; Microsoft Office 2010 All versions; and 4 more.
Is there a fix for CVE-2010-3333?
A patch was published on 2010-11-09: Microsoft released security updates to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-3333 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2010-3333?
Check whether you run Microsoft Office. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Microsoft Office XP SP3
  • Microsoft Office 2003 SP3
  • Microsoft Office 2007 SP2
  • Microsoft Office 2010 All versions
  • Microsoft Office 2004 for Mac All versions
  • Microsoft Office 2008 for Mac All versions
  • Microsoft Office for Mac 2011 All versions
  • Microsoft Open XML File Format Converter for Mac All versions

Timeline

  • 2010-11-09: advisory: Microsoft Security Bulletin MS10-087 published.
  • 2010-11-09: patched: Microsoft released security updates to address the vulnerability.
  • 2022-03-03: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.