CVE-2010-1901
Microsoft Word - Remote Code Execution via RTF Parsing Engine
Title source: llmDescription
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly handle unspecified properties in rich text data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Word RTF Parsing Engine Memory Corruption Vulnerability."
References (3)
Core 3
Core References
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA10-222A.html
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11612
Scores
EPSS
0.1940
EPSS Percentile
97.0%
Details
CWE
CWE-94
Status
published
Products (8)
microsoft/office
2004
microsoft/office
2008
microsoft/office_compatibility_pack
2007 sp2
microsoft/office_word_viewer
microsoft/open_xml_file_format_converter
microsoft/word
2002 sp3
microsoft/word
2003 sp3
microsoft/word
2007 sp2
Published
Aug 11, 2010
Tracked Since
Feb 18, 2026