CVE-2010-3970: Windows Shell Graphics CreateSizedDIBSECTION stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a high EPSS score and public exploit code, but exploitation requires the victim to open a crafted file and the affected platforms are legacy Windows versions.

What it is

The CreateSizedDIBSECTION function in shimgvw.dll, the Windows Shell graphics processor, has a stack-based buffer overflow triggered by a crafted thumbnail bitmap with a negative biClrUsed value. A remote attacker can deliver a malicious .MIC or Office document that causes the overflow when the thumbnail is processed, leading to arbitrary code execution on affected Windows versions.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the process handling the thumbnail, typically the logged-on user. That allows installation of malware, data theft, or further compromise of the host.

Attack surface

The flaw is reached through a crafted .MIC or Office document containing a malicious thumbnail bitmap, delivered remotely (AV:N). No authentication is required, but the CVSS vector indicates medium attack complexity and the victim must open or preview the file, so user interaction is effectively required.

Exploitation

CVE-2010-3970 is not listed in CISA KEV, but EPSS is high at 0.677 (99.3rd percentile) and public references include Metasploit and SecurityFocus entries tagged as Exploit, indicating public exploit code exists.

What to do

• Apply Microsoft security update MS11-006, which addresses the Windows Shell Graphics Processing Overrun Vulnerability.
• If patching cannot be done immediately, disable or restrict thumbnail and preview handlers for untrusted file types and block .MIC files at email and web gateways.
• Enforce attachment filtering and Mark-of-the-Web/Protected View so untrusted Office documents and images are not rendered by the shell graphics engine.
• Upgrade or retire Windows XP, Server 2003, Vista, and Server 2008 systems, which are past end of support and cannot receive current fixes.
• Limit user privileges so code execution from a document handler does not run with administrative rights.

Detection

• Monitor for shimgvw.dll or explorer.exe crashes and unexpected child processes spawned from document or image preview activity.
• Alert on Office or .MIC files written to disk from email or browser downloads followed by shell thumbnail generation.
• Use EDR to flag process creation where explorer.exe or a preview handler is the parent of a script interpreter or command shell.
• Search for known Metasploit-generated .MIC or Office thumbnail payloads by file hash and filename patterns in email and file share logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.