CVE-2010-3333
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
Key facts
- CVSS score
- 7.8 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-787
- EPSS score
- 89.4% (100th percentile)
- In CISA KEV
- Yes, added March 3, 2022
- In EU EUVD
- Yes (EUVD-2010-3331)
- Published
- November 10, 2010
- NVD last modified
- June 16, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
Microsoft Office Stack-based Buffer Overflow Vulnerability
Added to the KEV catalog on March 3, 2022; federal remediation due March 24, 2022.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2010-3331 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.
View on the EU Vulnerability DatabaseAffected products
- microsoft / office
- microsoft / office
- microsoft / office
- microsoft / office
- microsoft / office
- microsoft / office
- microsoft / office
- microsoft / open xml file format converter
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880(Broken Link)
- http://secunia.com/advisories/38521(Broken Link)
- http://secunia.com/advisories/42144(Broken Link)
- http://securityreason.com/securityalert/8293(Broken Link)
- http://www.securityfocus.com/bid/44652(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1024705(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA10-313A.html(Third Party Advisory, US Government Resource)
- http://www.vupen.com/english/advisories/2010/2923(Broken Link)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3333(US Government Resource)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain