CVE-2010-2572highunder attackCWE-120

CVE-2010-2572

Published · Updated

Follow this CVE+ Monitor Microsoft PowerPoint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 59%
from disclosure to weapon
Published on NVDNov 10
CISA KEV+4228d
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

A flaw in older versions of Microsoft PowerPoint allows attackers to crash the program or run malicious code by sending a specially crafted PowerPoint file. When you open the file, the vulnerability is triggered automatically.

Technical detail

Buffer overflow in PowerPoint 2002 SP3 and 2003 SP3 parsing of legacy PowerPoint 95 format files enables remote code execution. The attack vector is a malicious document file; no user interaction beyond opening the file is required for exploitation. The vulnerability results in arbitrary code execution with user privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a