CVE-2010-0266
Microsoft Outlook - Code Injection
Title source: ruleDescription
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka "Microsoft Outlook SMB Attachment Vulnerability."
Exploits (4)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16699
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16700
metasploit
WORKING POC
EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
metasploit
WORKING POC
EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb
References (3)
Scores
EPSS
0.8280
EPSS Percentile
99.3%
Details
CWE
CWE-94
Status
published
Products (3)
microsoft/outlook
2002 sp3
microsoft/outlook
2003 sp3
microsoft/outlook
2007 sp1 (2 CPE variants)
Published
Jul 15, 2010
Tracked Since
Feb 18, 2026