CVE-2010-2572 : Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a cr

Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability."

Published 2010-11-10 03:00:02

Updated 2018-10-12 21:58:01

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

CVE-2010-2572 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Microsoft PowerPoint Buffer Overflow Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.

Added on 2022-06-08 Action due date 2022-06-22

Exploit prediction scoring system (EPSS) score for CVE-2010-2572

Probability of exploitation activity in the next 30 days: 92.47%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2010-2572

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2010-2572

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-2572

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12195

Repository / Oval Repository
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-088

Microsoft Security Bulletin MS10-088 - Important | Microsoft Docs

CVEs referencing this url
http://www.us-cert.gov/cas/techalerts/TA10-313A.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url

Products affected by CVE-2010-2572