What is CVE-2010-0266?

CVE-2010-0266 is a vulnerability in Microsoft Office, classified under Code Injection. Published 2010-07-15.

Is CVE-2010-0266 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Microsoft Office

CVE-2010-0266

Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary c…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.828 (99.3th percentile) — read the EPSS interpretation.

Affected products

Microsoft Office — versions xp, 2007, 2003
Microsoft Outlook — versions 2007, 2003, 2002
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

oval:org.mitre.oval:def:11623 (x_refsource_OVAL, signature, vdb-entry)
TA10-194A (US Government Resource, x_refsource_CERT, third-party-advisory)
MS10-045 (x_refsource_MS, vendor-advisory)

Frequently asked questions

What is CVE-2010-0266?: CVE-2010-0266 is a vulnerability in Microsoft Office, classified under Code Injection. Published 2010-07-15.
Is CVE-2010-0266 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.