{"schemaVersion":3,"id":"CVE-2011-0027","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property that triggers an integer wrap and a buffer overflow, aka \"ADO Record Memory Vulnerability.\"  NOTE: this might be a duplicate of CVE-2010-1117 or CVE-2010-1118.","dates":{"published":"2011-01-12T00:00:00.000Z","modified":"2024-08-06T21:43:13.832Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.54372,"percentile":0.99004,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.54372},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.54372,"percentile":0.99004}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.54372,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.54372,"percentile":0.99004}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"15984","name":"Microsoft Data Access Components - Remote Overflow (MS11-002)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/15984","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/15984.html","codes":["CVE-2011-0027","MS11-002"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"microsoft","product":"data_access_components","name":"data access components","label":"data_access_components","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.8:sp1","noFixRecorded":false,"fixedIn":null},{"text":"2.8:sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.8:sp1 | 2.8:sp2","eol":null,"hubHref":"/vendor/microsoft/data_access_components"},{"vendor":"microsoft","product":"windows_data_access_components","name":"windows data access components","label":"windows_data_access_components","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0","eol":null,"hubHref":"/vendor/microsoft/windows_data_access_components"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.vupen.com/english/advisories/2011/0075","label":"www.vupen.com/english/advisories/2011/0075","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://osvdb.org/70444","label":"osvdb.org/70444","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]},{"url":"http://www.securitytracker.com/id?1024947","label":"www.securitytracker.com/id?1024947","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/","label":"vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/","hostname":"vreugdenhilresearch.nl","tags":["X Refsource MISC"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12411","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12411","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/42804","label":"secunia.com/advisories/42804","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/45698","label":"www.securityfocus.com/bid/45698","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA11-011A.html","label":"www.us-cert.gov/cas/techalerts/TA11-011A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-002/","label":"www.zerodayinitiative.com/advisories/ZDI-11-002/","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC"]},{"url":"http://support.avaya.com/css/P8/documents/100124846","label":"support.avaya.com/css/P8/documents/100124846","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2011-01-12T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T21:43:13.832Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:17:40.514Z","stale":false,"partial":false}}