CVE-2010-0033: Microsoft PowerPoint 2003 stack buffer overflow via crafted document

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with complete impact and a high EPSS score, though exploitation requires user interaction and the affected product is a long-unsupported Office version.

What it is

Microsoft Office PowerPoint 2003 SP3 contains a stack-based buffer overflow in its handling of a crafted PowerPoint document, specifically in the TextBytesAtom record. Opening a malicious file can corrupt the stack and allow remote code execution in the context of the user. The flaw is remotely reachable and requires the victim to open the document, making it a classic document-based client-side attack.

Impact

An attacker who gets a victim to open a crafted PowerPoint file can execute arbitrary code with the privileges of the logged-on user, leading to full compromise of confidentiality, integrity and availability on that host.

Attack surface

Reached over the network via a malicious PowerPoint document delivered by email, web download or file share; no authentication is required, but user interaction (opening the file) is needed, consistent with the AV:N/AC:M/Au:N vector.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at roughly 0.51 (98.9th percentile), indicating elevated predicted exploitation likelihood; reference tags are limited to a US Government advisory and vendor/OVAL entries, with no public exploit tag.

What to do

• Apply Microsoft security bulletin MS10-004 for PowerPoint 2003 SP3, or upgrade to a supported Office release.
• Block or strip untrusted PowerPoint attachments at the mail gateway and restrict document downloads from untrusted sources.
• Open Office documents with Protected View or equivalent sandboxing where available, and disable automatic opening of embedded objects.
• Run Office under a low-privilege account and apply application allowlisting to limit post-exploitation execution.

Detection

• Monitor for PowerPoint 2003 processes spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Alert on Office applications loading documents from email attachment or temporary internet directories.
• Hunt for crash or exception events in POWERPNT.EXE correlated with recently opened .ppt files.
• Review endpoint telemetry for anomalous file writes or network connections originating from Office processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.