CVE-2010-0266

Microsoft Outlook - Code Injection

Title source: rule

Description

Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka "Microsoft Outlook SMB Attachment Vulnerability."

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16699
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16700
metasploit WORKING POC EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
metasploit WORKING POC EXCELLENT
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/email/ms10_045_outlook_ref_only.rb

Scores

EPSS 0.8280
EPSS Percentile 99.3%

Details

CWE
CWE-94
Status published
Products (3)
microsoft/outlook 2002 sp3
microsoft/outlook 2003 sp3
microsoft/outlook 2007 sp1 (2 CPE variants)
Published Jul 15, 2010
Tracked Since Feb 18, 2026