CVE-2010-0822: Microsoft Excel OBJ record stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with a 9.3 CVSS score and very high EPSS probability, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Microsoft Excel 2002 SP3, Office 2004/2008 for Mac, and the Open XML File Format Converter for Mac contain a stack-based buffer overflow triggered by a crafted OBJ (0x5D) record in an Excel file. Opening the malicious file can corrupt the stack and allow code execution in the context of the user. The flaw is remotely reachable through file delivery and carries a CVSS 2.0 base score of 9.3.

Impact

An attacker who gets a victim to open a crafted Excel file can execute arbitrary code with the privileges of the logged-on user, giving full control of confidentiality, integrity and availability on that host.

Attack surface

Reached by delivering a malicious Excel file that the target opens in an affected Excel or converter product; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required but some user interaction (opening the file) is needed.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at roughly 0.70 (99th percentile), indicating substantial predicted exploitation activity. Reference tags include a US Government Resource alert, and no public exploit tag is present in the record.

What to do

• Apply the Microsoft security update for MS10-038 on all affected Excel, Office for Mac and Open XML File Format Converter installations.
• Block or strip untrusted Excel attachments and OBJ-record-bearing spreadsheet files at mail and web gateways.
• Disable or restrict the Open XML File Format Converter where it is not required.
• Enforce least privilege and application allowlisting so a successful overflow cannot easily persist or spread.
• Retire or isolate end-of-life Office 2002/2004/2008 installations that cannot be patched.

Detection

• Monitor for Excel or converter processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on crashes or abnormal exits of Excel and the Open XML File Format Converter tied to recently opened documents.
• Hunt for Excel files containing OBJ (0x5D) records arriving from external senders or downloads.
• Correlate endpoint file-open telemetry with subsequent suspicious process creation or network connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.