CVE-2011-0105: Microsoft Excel uninitialized memory buffer overflow via crafted file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with complete impact and a very high EPSS score, though exploitation requires user interaction and no KEV listing or public exploit tag is present.

What it is

Microsoft Excel 2002 SP3, Office 2004/2008 for Mac, and the Open XML File Format Converter for Mac read a length value from uninitialized memory, causing a buffer overflow when processing a crafted Excel file. A remote attacker can exploit this to run arbitrary code in the context of the user opening the file. The flaw is a memory buffer overflow (CWE-119) in widely deployed Office components.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the user who opens the malicious file, enabling full compromise of the workstation. Because the CVSS vector rates confidentiality, integrity and availability all as complete, the attacker gains broad control over the host.

Attack surface

The vector is network-reachable with medium attack complexity and no authentication (AV:N/AC:M/Au:N), but exploitation requires the victim to open a crafted Excel file, so user interaction is effectively needed. No credentials are required; delivery is via a malicious document.

Exploitation

CVE-2011-0105 is not listed in CISA KEV, but EPSS is very high (0.70166, 99.3rd percentile), indicating strong predicted exploitation activity. Reference tags are limited to a US Government Resource advisory, with no public exploit or in-the-wild tag supplied.

What to do

• Apply Microsoft security bulletin MS11-021 for the affected Excel, Office for Mac and Open XML File Format Converter versions.
• Upgrade or remove end-of-life products such as Excel 2002 SP3 and Office 2004 for Mac that no longer receive security fixes.
• Block or quarantine untrusted Excel attachments and downloads at the email and web gateway.
• Enable Microsoft Office file validation and Protected View to reduce the impact of malformed documents.
• Run Office with least privilege and consider application allowlisting to limit post-exploitation execution.

Detection

• Monitor for Excel or Open XML File Format Converter processes spawning child processes such as cmd.exe, powershell.exe or wscript.exe.
• Alert on Office applications crashing or exiting abnormally while opening files from email or download directories.
• Hunt for Excel documents received from external senders that are opened and immediately followed by outbound network connections or file writes.
• Use endpoint telemetry to flag unusual module loads or memory corruption indicators in Excel processes handling untrusted files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.