CVE-2010-3333

Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution

CISA: Microsoft Office Stack-based Buffer Overflow Vulnerability

CVSS: —
EPSS: 89%p100
Published: —
Added to KEV: Mar 3, 2022

Analyze CVE-2010-3333 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

CVE-2010-3333 is a stack-based buffer overflow in the way Microsoft Office parses RTF (Rich Text Format) data. An attacker triggers it by convincing a user to open a specially crafted RTF file, including an RTF email that is handed to Office for rendering, with no authentication required beyond the user's action. Successful exploitation allows remote code execution in the context of the logged-on user, giving the attacker a foothold on the workstation. Any Microsoft Office installation within the affected range identified in the December 2012 Microsoft security bulletin is exposed; the source data does not enumerate specific version numbers. The flaw is actively exploited: it is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03, ransomware association unknown) and was used in targeted espionage, notably Kaspersky's 'Red October' campaign, with EPSS estimating an 89.5% probability of exploitation within 30 days (100th percentile).

What to do: Apply the Microsoft updates from the December 2012 security bulletin that fixes this RTF parsing flaw across all Office/Word installations, prioritized given the ~90% EPSS score and CISA KEV listing. As interim mitigation, block or inspect inbound RTF attachments at email gateways and configure Outlook to read email in plain text so RTF content does not open automatically in Office. Inventory legacy or unpatched Office installations that may have missed the 2012 update, since these remain the likely current exposure.

Product	Affected
Microsoft Office	—

Estimated exposure

masshundreds of millions of Office users/installations at time of disclosure (current unpatched legacy installs unknown) — Microsoft Office was effectively ubiquitous on enterprise desktops when the flaw was disclosed, so the potentially affected base far exceeds one million systems, though most environments applied the December 2012 updates.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.

KEVCISA Known Exploited Vulnerability