Microsoft · Office
CVE-2010-3333
Microsoft Office Stack-based Buffer Overflow Vulnerability
What it is
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
CISA: A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 24, 2022
- Added to the CISA list
- March 3, 2022
- Published
- November 10, 2010
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 89% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (10)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087
- http://www.securitytracker.com/id?1024705
- http://securityreason.com/securityalert/8293
- http://secunia.com/advisories/42144
- http://secunia.com/advisories/38521
- http://www.vupen.com/english/advisories/2010/2923
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931
- http://www.us-cert.gov/cas/techalerts/TA10-313A.html
- http://www.securityfocus.com/bid/44652
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 14, 2026 | Remote Code Execution | Office | High 8.8 | 43% |
| Feb 10, 2026 | Word Reliance on Untrusted Inputs in a Security Decision | Office | High 7.8 | 1.6% |
| Jan 26, 2026 | Security Feature Bypass | Office | High 7.8 | 71% |
| Jan 7, 2026 | PowerPoint Code Injection | Office | High 8.8 | 67% |
| Aug 12, 2025 | Excel Remote Code Execution | Office | High 8.8 | 43% |
| Mar 14, 2023 | Outlook Privilege Escalation | Office | Critical 9.8 | 97% |
| Feb 14, 2023 | Publisher Security Feature Bypass | Office | High 7.3 | 12% |
| Jun 8, 2022 | Object Record Corruption | Office | High 7.8 | 53% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.