CVE-2010-2590: SAP Crystal Reports ActiveX control heap buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityThe flaw is a remotely reachable heap overflow with public exploit code and a high EPSS score, though it is not in KEV and requires some user interaction.

What it is

The CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 (SAP Crystal Reports 2008 SP3 Fix Pack 3.2) contains a heap-based buffer overflow reachable through an overly long ServerResourceVersion property value. Successful exploitation allows arbitrary code execution in the context of the process hosting the control, making this a serious client-side risk for users of the affected viewer.

Impact

An attacker who can get the vulnerable control instantiated can corrupt heap memory and execute arbitrary code with the privileges of the hosting application or browser. That typically means full compromise of the user's session and the ability to run further payloads on the workstation.

Attack surface

The flaw is reached remotely over the network by supplying a crafted ServerResourceVersion value to the ActiveX control, which is instantiated in a browser or application that loads PrintControl.dll. No authentication is required, but the CVSS vector (AV:N/AC:M/Au:N) indicates some user interaction or a non-trivial condition is needed to trigger the control.

Exploitation

Public exploit code exists, as shown by the Exploit and Exploit-DB reference tags, and EPSS is high at roughly 0.468 (98.8th percentile). The CVE is not listed in CISA KEV, so there is no confirmed evidence of widespread in-the-wild exploitation from that source.

What to do

• Apply the SAP support note 1539269 fix or upgrade to a Crystal Reports build that removes or patches the vulnerable PrintControl.dll version.
• Disable or kill-bit the CrystalReports12.CrystalPrintControl.1 ActiveX control in browsers and applications that do not require it.
• Restrict use of the Crystal Reports viewer to trusted internal sites and block untrusted web content from instantiating ActiveX controls.
• Enforce least privilege on workstations so code execution from the control does not run with administrative rights.
• Monitor for and remove the affected PrintControl.dll 12.3.2.753 from endpoints where Crystal Reports 2008 SP3 Fix Pack 3.2 is no longer needed.

Detection

• Search endpoints for PrintControl.dll with version 12.3.2.753 and flag hosts that still have it registered.
• Monitor browser and application crash reports or process creation events tied to the Crystal Reports viewer or ActiveX host processes.
• Look for network requests or documents that deliver a long ServerResourceVersion value to the control, and alert on anomalous ActiveX instantiation from untrusted origins.
• Review proxy and endpoint logs for known exploit URLs or payloads associated with the public exploit references for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.