{"id":"CVE-2010-3333","published":"2010-11-10T03:00:02Z","modified":"2026-06-16T23:22:36Z","title":"Microsoft Office Stack-based Buffer Overflow Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka \"RTF Stack Buffer Overflow Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"A stack-based buffer overflow in Microsoft Office (including Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and the Open XML File Format Converter for Mac) lets an attacker execute arbitrary code by supplying crafted RTF data. Exploitation requires user interaction, since the victim must open the malicious RTF content.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:10:59Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.89389,"percentile":0.99783,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-3333","provenance":"source"},"vulncheckKev":{"dateAdded":"2012-01-01","exploitedFirstSeen":"2012-01-01","ransomware":false,"evidence":[{"url":"https://documents.trendmicro.com/assets/wp/wp_luckycat_redux.pdf","date":"2012-01-01"},{"url":"https://1vx.ug/archive/Symantec/luckycat-hackers-12-en.pdf","date":"2012-03-01"},{"url":"https://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740/","date":"2013-01-14"},{"url":"https://securelist.com/adobe-flash-player-0-day-and-hackingteams-remote-control-system/64215/","date":"2013-02-12"},{"url":"https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465/","date":"2013-03-14"},{"url":"https://securelist.com/nettraveler-is-running-red-star-apt-attacks-compromise-high-profile-victims/35936/","date":"2013-06-04"},{"url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf","date":"2014-01-01"},{"url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf","date":"2014-02-01"},{"url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/bcs_wp_InceptionReport_EN_v12914.pdf","date":"2014-12-09"},{"url":"https://blog.paloaltonetworks.com/2014/12/proactive-prevention-revisited-cloud-atlas-inception-framework-campaigns/","date":"2014-12-18"}],"evidenceTotal":25,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/38521","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/42144","tags":["Broken Link"]},{"url":"http://securityreason.com/securityalert/8293","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/44652","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1024705","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-313A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2010/2923","tags":["Broken Link"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931","tags":["Broken Link"]},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/38521","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/42144","tags":["Broken Link"]},{"url":"http://securityreason.com/securityalert/8293","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/44652","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1024705","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-313A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2010/2923","tags":["Broken Link"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3333","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Stack overflow yields code execution in Office","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":197,"end":246}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: User opens malicious RTF document","mappingType":"uncategorized","evidence":[{"from":"description","quote":"via crafted RTF data","start":247,"end":267}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-62aa640e098a9c9dc263","title":"Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","date":"2016-01-24","mentions":[{"quote":"- CVE-2010-3333","start":8967,"end":8982}]},{"id":"SRC-eb7353d6a948899d0c6a","title":"Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers","publisher":"documents.trendmicro.com","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf","date":null,"mentions":[{"quote":"CVE-2010-3333 and CVE-2012-0158—to infiltrate","start":4964,"end":5009},{"quote":"vulnerabilities, particularly CVE-\r\n2010-3333 and CVE-2012-","start":6141,"end":6200}]},{"id":"SRC-8b9769365d9094d4bb69","title":"BlackEnergy & Quedagh: The convergence of crimeware and APT attacks","publisher":"blog-assets.f-secure.com","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf","date":null,"mentions":[{"quote":"vulnerabilities, one of which was CVE-2010-3333.","start":4851,"end":4899}]},{"id":"SRC-886ee8388cf5400c59a7","title":"TheNaikonAPT MsnMM1","publisher":"media.kasperskycontenthub.com","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf","date":null,"mentions":[{"quote":"exploiting CVE-2010-3333.","start":15761,"end":15786}]},{"id":"SRC-34d3d0da0eb12f3882ef","title":"Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years","publisher":"sentinelone.com","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/","date":null,"mentions":[{"quote":"During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.","start":2051,"end":2163}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-3331","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-3331","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":16686,"url":"https://www.exploit-db.com/exploits/16686","title":"Microsoft Word - '.RTF' pFragments Stack Buffer Overflow (File Format) (MS10-087) (Metasploit)","type":"local","platform":"windows","date":"2011-03-04","verified":true,"provenance":"source"},{"id":17474,"url":"https://www.exploit-db.com/exploits/17474","title":"Microsoft Office 2010 - '.RTF' Header Stack Overflow","type":"local","platform":"windows","date":"2011-07-03","verified":true,"provenance":"source"},{"id":18334,"url":"https://www.exploit-db.com/exploits/18334","title":"Microsoft Office 2003 Home/Pro - Code Execution (MS10-087)","type":"local","platform":"windows","date":"2012-01-08","verified":true,"provenance":"source"},{"id":24526,"url":"https://www.exploit-db.com/exploits/24526","title":"Microsoft Office 2010 - Download Execute","type":"remote","platform":"windows","date":"2013-02-20","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2011-03-04"},"pocGithub":{"count":1,"skipped":1,"earliest":"2022-08-15","earliestUrl":"https://github.com/Sunqiz/CVE-2010-3333-reproduction","repos":[{"name":"Sunqiz/CVE-2010-3333-reproduction","url":"https://github.com/Sunqiz/CVE-2010-3333-reproduction","stars":1,"created":"2022-08-15"}]},"metasploit":[{"name":"MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)","module":"exploit/windows/fileformat/ms10_087_rtf_pfragments_bof","type":"exploit","disclosureDate":"2010-11-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb"}],"first":{"date":"2010-11-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1203","T1204.002"],"provenance":"source"}],"timeline":[{"date":"2010-11-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2011-03-04, PoC-in-GitHub 2022-08-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb","provenance":"source"},{"date":"2010-11-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3333","provenance":"source"},{"date":"2012-01-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://documents.trendmicro.com/assets/wp/wp_luckycat_redux.pdf","provenance":"source"},{"date":"2016-01-24","kind":"report","label":"Named in unit42.paloaltonetworks.com: Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists","url":"https://unit42.paloaltonetworks.com/scarlet-mimic-years-long-espionage-targets-minority-activists/","provenance":"machine"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-3331","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4131},"priority":{"score":78.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5415 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9978"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-119"}}