CVE-2010-3333: Microsoft Office RTF stack buffer overflow allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed exploitation via CISA KEV and a very high EPSS score, but exploitation requires a user to open a crafted document and a vendor patch has existed since 2010.

What it is

A stack-based buffer overflow in Microsoft Office (XP SP3, 2003 SP3, 2007 SP2, 2010, and Mac editions) and the Open XML File Format Converter for Mac is triggered by crafted RTF data. Because the overflow is reachable through document parsing, opening a malicious file can corrupt the stack and hand control to attacker-supplied code. The flaw is old but still listed in CISA's KEV catalog, so unpatched Office installs remain a real target.

Impact

An attacker who gets a victim to open a crafted RTF document can execute arbitrary code in the context of the Office process, giving full control of confidentiality, integrity and availability on the host.

Attack surface

Reached locally by opening or previewing a malicious RTF file in an affected Office product; the CVSS vector shows no privileges required but user interaction required (UI:R), so the victim must open the document. No network service exposure is described.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-03, confirming real-world exploitation, and EPSS gives a 30-day probability of about 0.895 (99.8th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft MS10-087 update to all affected Office and Open XML File Format Converter installations.
• Remove or upgrade end-of-life Office versions (XP, 2003, 2004/2008 for Mac) that no longer receive security fixes.
• Block or strip RTF content at email and web gateways where business use does not require it.
• Disable or restrict opening of untrusted Office documents and enforce Protected View / file block settings.
• Track KEV remediation due dates and verify patched status across endpoints.

Detection

• Monitor for Office processes (winword.exe, excel.exe, powerpnt.exe) spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office crashes or stack-corruption events tied to recently opened RTF or Office documents.
• Search email and file shares for RTF attachments or embedded RTF objects from untrusted senders.
• Hunt for known exploit artifacts or shellcode patterns in RTF files using YARA or content inspection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.