Log in Start free

Actively exploited · Published Nov 10, 2010 · Assigned by microsoft

CVE-2010-3333

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in Office from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 89.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)89.4%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Mar 3, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References