CVE-2010-1900: microsoft office Code Injection

Vulnerability summary

CVE-2010-1900 is a high (CVSS 9.3) Code Injection vulnerability in microsoft office. EPSS estimates a 39.81% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-08-2010
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Works 9 do not properly handle malformed records in a Word file, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, aka "Word Record Parsing Vulnerability."

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.