60
CVE-2010-3333
KEVmass1Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution
CISA: Microsoft Office Stack-based Buffer Overflow Vulnerability
CVSS
—
EPSS
89%p100
Published
—
KEV added
AI analysis
CVE-2010-3333 is a stack-based buffer overflow in the way Microsoft Office parses RTF (Rich Text Format) data. An attacker triggers it by convincing a user to open a specially crafted RTF file, including an RTF email that is handed to Office for rendering, with no authentication required beyond the user's action. Successful exploitation allows remote code execution in the context of the logged-on user, giving the attacker a foothold on the workstation. Any Microsoft Office installation within the affected range identified in the December 2012 Microsoft security bulletin is exposed; the source data does not enumerate specific version numbers. The flaw is actively exploited: it is on the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03, ransomware association unknown) and was used in targeted espionage, notably Kaspersky's 'Red October' campaign, with EPSS estimating an 89.5% probability of exploitation within 30 days (100th percentile).
What to do: Apply the Microsoft updates from the December 2012 security bulletin that fixes this RTF parsing flaw across all Office/Word installations, prioritized given the ~90% EPSS score and CISA KEV listing. As interim mitigation, block or inspect inbound RTF attachments at email gateways and configure Outlook to read email in plain text so RTF content does not open automatically in Office. Inventory legacy or unpatched Office installations that may have missed the 2012 update, since these remain the likely current exposure.
Affected
| Microsoft Office | — |
Estimated exposure
masshundreds of millions of Office users/installations at time of disclosure (current unpatched legacy installs unknown) — Microsoft Office was effectively ubiquitous on enterprise desktops when the flaw was disclosed, so the potentially affected base far exceeds one million systems, though most environments applied the December 2012 updates.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
CISA Known Exploited Vulnerability
- Affected
- Microsoft Office
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
- Vendors
- Microsoft
- Products
- Office
- Weakness
- CWE-119
In the news20 stories
60
60
60
60
60
60
60
60
60
47
47
47
47
47
47
47
New Malware 'Rover' Targets Indian Ambassador to Afghanistan
Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.
On December 24, 2015, Unit 42 identified a targeted spearphishing email spoofing Indian Defence Minister Manohar Parrikar, sent to India's Ambassador to Afghanistan. The RTF attachment exploited CVE-2010-3333 in Microsoft Word to download a downloader from newsumbrella.net, which retrieved the Rover Trojan and DLL plugins from 46.166.165.254. Rover uses OpenCV for webcam capture, OpenAL for audio recording and libsndfile for audio files, with data exfiltration over its C2 channel; separate payload versions target Windows XP and later systems.
40
35
35