Microsoft Office
CVE-2010-3333
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malicious RTF document
-
DeliveryDeliver via email/web download
-
ExploitUser opens document
-
InstallTrigger buffer overflow in RTF parser
-
C2Overwrite stack return address
-
ExecuteExecute embedded shellcode
-
ImpactEstablish persistence/download payload
-
Step 8Exfiltrate data or pivot laterally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user to open a specially crafted RTF document using vulnerable Microsoft Office 2003-2010 or Office for Mac 2004-2011 installations. No authentication, network services, or non-default configurations required - exploitation succeeds against standard Office installations with default settings. The CVSS vector PR:N confirms no privileges needed, and UI:R indicates user interaction (opening the document) is the sole prerequisite. Exploitation is limited by user willingness to open untrusted documents, though social engineering effectively overcomes this barrier in targeted attacks. Email security controls (attachment filtering, sandboxing) and user awareness training reduce but do not eliminate risk. The local attack vector (AV:L) in CVSS reflects the technical execution happening on the local system, but RTF documents are trivially delivered remotely, making this distinction less meaningful for risk assessment. |
| Impact | This represents CRITICAL real-world risk with multiple confirming signals. CISA KEV status confirms active exploitation in real-world attacks. EPSS score of 93.79% (100th percentile) indicates this vulnerability is exploited more frequently than 99.99% of all known CVEs. Public exploit code availability lowers the barrier for attackers. The CVSS 3.1 score of 7.8 reflects local attack vector (AV:L) requiring user interaction (UI:R), which might suggest lower risk, but this is misleading for document-based attacks where email delivery of malicious RTF files is trivial and user interaction (opening a document) is routine business activity. The combination of high impact (C:H/I:H/A:H - complete system compromise), no required privileges (PR:N), and low complexity (AC:L) with confirmed exploitation makes this a top-tier remediation priority. The only mitigating factor is the attack vector classification as local, but in practice RTF documents are delivered remotely via email/web and executed locally, making this effectively a remote threat. Organizations with unpatched Office installations from 2003-2010 face immediate compromise risk. |
| Exploit ScenarioDerived | Attacker crafts a malicious RTF document containing oversized data fields designed to overflow stack buffers during parsing. The document is delivered via spear-phishing email with social engineering pretexts (invoice, resume, contract) to target employees. When the victim opens the RTF file in vulnerable Office versions, the RTF parser processes the malicious data, overflows the stack buffer, overwrites the return address, and redirects execution to attacker-controlled shellcode embedded in the document. The shellcode executes with the privileges of the logged-in user, typically establishing persistence, downloading additional payloads, and exfiltrating credentials or sensitive data. Public exploit code availability means even low-skill attackers can weaponize this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 22, 2026
Remote code execution in Microsoft Office 2003-2010 and Office for Mac 2004-2011 allows attackers to execute arbitrary code via malicious RTF documents. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 93.79% (100th percentile), indicating extremely high real-world exploitation likelihood. Microsoft released patches via security bulletin MS10-087. The vulnerability affects a wide range of Office versions across Windows and macOS platforms, representing significant enterprise exposure despite the 2010 disclosure date.
Earlier versions of this analysis (1)
A stack-based buffer overflow in Microsoft Office's RTF (Rich Text Format) parser allows remote attackers to execute arbitrary code by sending documents with specially crafted RTF data structures.
RemediationAI
Apply Microsoft Security Bulletin MS10-087 immediately, available at https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087, which provides specific patches for each affected Office version. Given the age of these products (2003-2010), Microsoft mainstream support has ended, making migration to modern, supported Office versions (Office 2016 or later, preferably Office 365/Microsoft 365) the preferred long-term solution. As interim compensating controls: configure email gateways to block or quarantine RTF file attachments (.rtf extension), which eliminates the primary delivery vector but may disrupt legitimate business workflows requiring RTF document exchange; enable Office Protected View for files from untrusted sources, though this feature is only available in Office 2010 and provides defense-in-depth rather than complete protection; restrict user permissions to prevent code execution at elevated privileges, limiting post-exploitation impact but not preventing initial compromise. Deploy endpoint detection and response (EDR) solutions configured to detect stack-based buffer overflow exploitation attempts and suspicious Office child processes. Note that organizations still running Office 2003-2010 likely face compliance and security posture issues beyond this single CVE.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a stack-based buffer overflow (CWE-787) in Microsoft Office's RTF (Rich Text Format) parsing engine. RTF is a document format that supports text formatting, embedded objects, and complex document structures. The vulnerability occurs when Office processes specially crafted RTF data that writes beyond allocated stack memory boundaries. Affected products span from Office XP SP3 through Office 2010 on Windows, Office 2004 through Office 2011 on macOS, and the Open XML File Format Converter for Mac. The RTF parser's failure to properly validate input sizes before copying data to fixed-size stack buffers creates the exploitable condition. Stack-based overflows are particularly dangerous because they can overwrite return addresses and enable precise control flow hijacking, leading to arbitrary code execution at the privilege level of the Office application.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
Executive ViewAI
CVE-2010-3333 is a critical remote code execution vulnerability in Microsoft Office 2003-2010 affecting Windows and Mac platforms, enabling attackers to execute arbitrary code through malicious RTF documents. This vulnerability is confirmed actively exploited with an exceptionally high exploitation probability (93.8% EPSS), creating immediate risk to any organization still running legacy Office versions. Organizations using unsupported Office versions face direct compromise of user workstations and potential lateral movement throughout the enterprise.
Vendor-released patch: Microsoft Security Bulletin MS10-087 provides updates for Office 2003, 2007, and 2010. For systems where patching is not immediately possible: disable RTF preview pane in Outlook, block RTF file attachments at email gateways, restrict Office macro execution permissions, implement application whitelisting to prevent code execution from Office temp directories, and apply network segmentation to limit exposure of legacy systems.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC