Microsoft Office Stack-based Buffer Overflow Vulnerability (CVE-2010-3333)

What is affected, what to do

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Office eq 2003..2003
• Microsoft Office eq 2004..2004
• Microsoft Office eq 2007..2007
• Microsoft Office eq 2008..2008
• Microsoft Office eq 2010..2010
• Microsoft Office eq 2011..2011
• Microsoft Office eq xp..xp

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory legacy Office: Use SCCM/Intune or EDR inventory to find every host running Office XP, 2003, 2007, 2010, Office for Mac 2004/2008/2011 or the Open XML File Format Converter for Mac. All affected products are long out of support. Treat each hit as a vulnerability-management finding, not just a patch ticket.
   • Apply the patch: A patch is available from the vendor. Look up the bulletin and fixed version in the Microsoft advisory for CVE-2010-3333. Verify the patch level on every legacy install now and close any gaps. Long term, only migration to a supported Office release is sustainable.
   • Isolate unpatched hosts: Move hosts with unpatched legacy Office into a quarantine VLAN without internet or mail access until they are fixed, or uninstall Office on them.
   • Quarantine RTF at the mail gateway: Hold inbound RTF attachments for now. This includes .rtf files and any .doc/.docx/.dot carrying the {\rtf signature. Match on magic bytes, not extension, because attackers routinely rename RTF to .doc.
   • Retro-hunt: Search the last 30 days of mail logs and sandbox verdicts for delivered RTF attachments. Prioritise recipients running legacy Office for a compromise assessment (see Detection rules).
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration (Office): Use GPO to set Word Trust Center "File Block Settings" so RTF is blocked, or opened only in Protected View. On Office 2007/2010, also enforce Outlook's "Read all standard mail in plain text". Outlook renders RTF mail through Word, so the preview pane alone is an attack path.
   • Endpoint hardening (ASR): On Windows hosts running Microsoft Defender, enable these Attack Surface Reduction rules in block mode:
     • D4F940AB-401B-4EFC-AADC-AD5F3C50688A (block Office child processes)
     • 3B576869-A4EC-4529-8536-B80A7769E899 (block Office from creating executable content)
     • 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 (block Office process injection)
   • Application control: Use AppLocker or WDAC to deny execution from %TEMP%, %APPDATA% and download folders. RTF exploit shellcode typically drops its payload there.
   • Network/IPS: Deploy a Suricata or Snort rule on SMTP, HTTP and SMB file transfers that fires on RTF content ({\rtf) combined with the pFragments shape-property string. This is the classic exploit pattern for this bug.
   • Least privilege: Run end users without local admin rights. This limits persistence and lateral movement after successful code execution.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / EDR): Alert on child processes spawned by WINWORD.EXE.
     • Sigma shape: ParentImage|endswith: '\WINWORD.EXE' and Image|endswith: ['\cmd.exe','\powershell.exe','\wscript.exe','\mshta.exe','\rundll32.exe','\regsvr32.exe']
     • KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "winword.exe" and FileName in~ ("cmd.exe","powershell.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe")
   • File drops (Sysmon EID 11): WINWORD.EXE writing .exe, .dll, .scr or .vbs files into %TEMP% or %APPDATA%. This is often followed by a decoy document opening.
   • Crash artefacts (Windows Application log EID 1000/1001): Application errors with faulting application WINWORD.EXE and faulting module mso.dll. These point to failed or unstable exploit attempts.
   • Mail and file telemetry: Attachments whose extension (.doc) does not match their content (RTF magic {\rtf). Run a YARA rule on {\rtf plus pFragments with an oversized hex value across gateway logs and file shares.
   • Network (Zeek/Suricata): Outbound HTTP/DNS from a host shortly after an RTF attachment was opened, especially to newly registered domains or raw IP addresses.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Office
• Microsoft Microsoft Open XML File Format Converter for Mac

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• securitytracker.com1024705Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• securityreason.com8293Third-party advisory, x_refsource_SREASON, Broken link
• secunia.com42144Third-party advisory, x_refsource_SECUNIA, Broken link
• secunia.com38521Third-party advisory, x_refsource_SECUNIA, Broken link
• vupen.comADV-2010-2923Vulnerability database, x_refsource_VUPEN, Broken link
• labs.idefense.com20101109 Microsoft Word RTF File Parsing Stack Buffer Overflow VulnerabilityThird-party advisory, x_refsource_IDEFENSE, Broken link
• oval.cisecurity.orgoval:org.mitre.oval:def:11931Vulnerability database, signature, x_refsource_OVAL, Broken link
• docs.microsoft.comMS10-087Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• us-cert.govTA10-313AThird-party advisory, x_refsource_CERT, Third-party advisory, US government resource
• securityfocus.com44652Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3333government-resource, US government resource