CVE-2011-0104: Microsoft Excel HLink record buffer overflow allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS v2 9.3 and a 99th-percentile EPSS score indicate severe impact and high predicted exploitation, though the affected products are legacy and no KEV listing or confirmed in-the-wild use is recorded.

What it is

Microsoft Excel 2002 SP3, Excel 2003 SP3, Office 2004 and 2008 for Mac, and the Open XML File Format Converter for Mac contain a memory corruption flaw triggered by a crafted HLink record in an Excel file. A remote attacker can exploit it to execute arbitrary code or cause a denial of service. The record is old but the flaw is a classic client-side file-parsing overflow with a very high CVSS v2 score of 9.3.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the user opening the file, or crashes the application. Full confidentiality, integrity and availability impact is scored.

Attack surface

Reached by getting a victim to open a malicious Excel file, typically via email attachment or a hosted download; the CVSS vector AV:N/AC:M/Au:N indicates network delivery with no authentication but some user interaction (opening the file). No server-side or pre-auth path is described.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.53431 (99th percentile), indicating high predicted likelihood of exploitation activity. References are vendor and government advisories only, with no public exploit tag supplied.

What to do

• Apply the Microsoft MS11-021 security update for all affected Excel, Office for Mac and Open XML File Format Converter installations.
• Block or strip untrusted Excel attachments at the mail and web gateway, and disable automatic opening of Office documents from external sources.
• Where the affected versions cannot be patched, retire or isolate them; Excel 2002/2003 and Office 2004/2008 are long out of support.
• Enforce Office Protected View and file-blocking policies for legacy .xls content from untrusted zones.
• Restrict users from opening documents received from unknown senders and educate on attachment handling.

Detection

• Monitor for Excel or Open XML File Format Converter processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Hunt for Office application crashes or abnormal terminations correlated with recently received .xls attachments.
• Inspect email and proxy logs for .xls attachments from external senders, especially those matching known malicious HLink patterns.
• Use endpoint telemetry to flag writes to startup folders or system directories originating from Office processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.