CVE-2010-4701: Windows Fax Cover Page Editor heap buffer overflow via .cov file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is a remotely reachable heap overflow with public exploit code and a very high EPSS score, but it requires a user to open a crafted file and is not in CISA KEV.

What it is

The CDrawPoly::Serialize function in fxscover.exe, the Microsoft Windows Fax Services Cover Page Editor 5.2 r2, contains a heap-based buffer overflow (CWE-119). A long record in a Fax Cover Page (.cov) file overflows the heap, and the flaw affects Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, and Windows 7 Professional. Because the editor is used to open cover page files, a crafted file can crash the process or run attacker code.

Impact

An attacker who gets a victim to open a malicious .cov file can execute arbitrary code in the context of the user running fxscover.exe. That gives the attacker the user's privileges, and potentially full control of the host if the user is an administrator.

Attack surface

The flaw is reached remotely by delivering a crafted Fax Cover Page (.cov) file that the victim opens in the Fax Cover Page Editor; the AV:N vector and the file-based trigger mean no authentication is required, but user interaction (opening the file) is needed. The record does not state whether the file can be opened automatically or through a service, so the practical path is a user opening the file.

Exploitation

Public exploit code exists, as shown by the Exploit tags on the retrogod and Exploit-DB references, and EPSS is high at 0.47832 (98.8th percentile). The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in this data.

What to do

• Apply the Microsoft security update that addresses the fxscover.exe heap overflow, or upgrade off the affected Windows XP, Server 2003, and Windows 7 versions if they are no longer supported.
• Block or restrict opening of untrusted .cov files, for example by removing the Fax Cover Page Editor file association or by blocking .cov attachments at the mail gateway.
• If Fax Services Cover Page Editor is not needed, disable or remove the Fax Services component to eliminate the attack surface.
• Warn users not to open .cov files from email, downloads, or removable media, and enforce attachment filtering for that extension.

Detection

• Monitor for fxscover.exe spawning child processes or making network connections, which would indicate code execution from a crafted .cov file.
• Alert on fxscover.exe crashes or heap corruption events tied to opening .cov files.
• Hunt for .cov files arriving as email attachments or being written to user download and temp directories, then opened by fxscover.exe.
• Use the OVAL definition referenced in the record to check for the missing patch on affected hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.