CVE-2011-0027
Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka "ADO Record Memory Vulnerability." NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.
Key facts
- CVSS score
- 9.3 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-20
- EPSS score
- 54.4% (99th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2011-0053)
- Published
- January 12, 2011
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2011-0053 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / data access components
- microsoft / data access components
- microsoft / windows 2003 server
- microsoft / windows 7
- microsoft / windows data access components
- microsoft / windows server 2003
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows vista
- microsoft / windows vista
- microsoft / windows xp
- microsoft / windows xp
References
- http://osvdb.org/70444
- http://secunia.com/advisories/42804(Vendor Advisory)
- http://support.avaya.com/css/P8/documents/100124846
- http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/
- http://www.securityfocus.com/bid/45698
- http://www.securitytracker.com/id?1024947
- http://www.us-cert.gov/cas/techalerts/TA11-011A.html(US Government Resource)
- http://www.vupen.com/english/advisories/2011/0075(Vendor Advisory)
- http://www.zerodayinitiative.com/advisories/ZDI-11-002/
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12411
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain