Vulnerability record · CVE-2003-0347 · published 20 October 2003
CVE-2003-0347: Microsoft VBA SDK VBE DLL heap buffer overflow via long ID parameter
Microsoft · Office
VBE.DLL and VBE6.DLL in the Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 contain a heap-based buffer overflow triggered by a document containing a long ID parameter. Because the affected DLLs ship with widely deployed Microsoft products such as Office, Project and Visio, a crafted document can corrupt memory and lead to code execution in the context of the opening application.
Description
Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID parameter.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityNetwork-reachable, unauthenticated code execution with complete impact and a high EPSS score, tempered by the age of the flaw and the user interaction required.
What it is
VBE.DLL and VBE6.DLL in the Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 contain a heap-based buffer overflow triggered by a document containing a long ID parameter. Because the affected DLLs ship with widely deployed Microsoft products such as Office, Project and Visio, a crafted document can corrupt memory and lead to code execution in the context of the opening application.
Impact
A remote attacker can execute arbitrary code with the privileges of the user who opens the malicious document, giving full control of confidentiality, integrity and availability on the affected host.
Attack surface
Reached remotely over the network by delivering a crafted document that is opened by a vulnerable application loading VBE.DLL or VBE6.DLL; no authentication is required, but the victim must open or otherwise process the document, so user interaction is needed.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.55 (99th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.
What to do
- Apply the Microsoft security update referenced in MS03-037 for all affected products (Office, Project, Visio, Visual Basic).
- Block or strip untrusted documents at email and web gateways, and warn users not to open unexpected attachments.
- Disable or restrict VBA/document automation where business needs allow, and enforce least privilege so document-opening users are not administrators.
- Retire or isolate systems still running VBA SDK 5.0 through 6.3 that cannot be patched.
Detection
- Monitor for document-processing applications (Office, Project, Visio) crashing or spawning unexpected child processes such as cmd.exe or scripting hosts.
- Alert on unusual outbound network connections originating from document viewer processes.
- Hunt for documents containing abnormally long ID parameters or malformed VBA-related structures in email and file-share telemetry.
- Review endpoint logs for exploitation artifacts around VBE.DLL/VBE6.DLL loads in non-standard paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0347 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0347), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
