CVE-2010-2572
Microsoft PowerPoint Buffer Overflow Vulnerability
Description
CVE-2010-2572 is a buffer overflow vulnerability in Microsoft PowerPoint that allows remote attackers to execute arbitrary code via a specially crafted PowerPoint presentation file. The flaw occurs when PowerPoint processes a malformed presentation that triggers a buffer overflow during file parsing, enabling an attacker to execute code in the context of the logged-in user. CISA has added CVE-2010-2572 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 74.7% (98th percentile), this vulnerability has a high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | powerpoint | 2002; 2003 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.us-cert.gov/cas/techalerts/TA10-313A.html(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-088(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12195(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2572(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2010-2572 exploits a classic buffer overflow in Microsoft PowerPoint's file parsing routines, where the application copies data from a crafted presentation file into a fixed-size buffer without verifying that the input data fits within the allocated memory. This allows the attacker to overwrite adjacent memory and redirect program execution.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Impact Analysis
CVE-2010-2572 is remotely exploitable through a crafted PowerPoint file — an attacker needs only to convince a victim to open a malicious presentation delivered via email, web download, or file sharing. No authentication is required, though user interaction is needed to open the file. Successful exploitation results in arbitrary code execution with the privileges of the current user, which can lead to full system compromise if the user has administrative rights. Confidentiality, integrity, and availability are all at risk, as an attacker can steal data, install persistent malware, or disrupt operations. The EPSS score of 74.7% (98th percentile) indicates a high probability of exploitation, making this a priority for organizations still running legacy PowerPoint versions.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2010-2572 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 8, 2022. The EPSS score of 74.7% places this vulnerability in the 98th percentile, indicating a high probability of exploitation. The document-based attack vector through PowerPoint presentations makes this vulnerability well-suited for spear-phishing campaigns targeting organizations that use legacy Office versions. No specific ransomware association has been reported, but the remote code execution capability through commonly exchanged document formats makes it valuable for diverse attack campaigns.
Remediation
- Apply Microsoft security updates immediately: Install the relevant security patches for Microsoft PowerPoint as directed by the CISA KEV required action to address the buffer overflow vulnerability.
- Upgrade legacy Office installations: If running Office 2003 or 2007, upgrade to a currently supported version of Microsoft Office that includes modern exploit mitigations such as ASLR, DEP, and Control Flow Guard.
- Enable Protected View for PowerPoint files: Ensure Microsoft Office Protected View is enabled for all presentations received from external sources, which opens files in a restricted sandbox.
- Deploy email attachment filtering: Configure email security gateways to scan and quarantine PowerPoint files with suspicious structures, particularly files targeting older format versions (PPT vs PPTX).
- Monitor for suspicious PowerPoint process behavior: Configure endpoint detection to alert on unusual PowerPoint process activity such as unexpected child process creation, network connections, or memory access violations that may indicate buffer overflow exploitation.
Technical Details
CVE-2010-2572 is a buffer overflow vulnerability in Microsoft PowerPoint's file format parser that is triggered when the application processes a crafted presentation file with malformed record structures. During parsing, PowerPoint copies record data into a fixed-size buffer without properly validating the data length against the buffer capacity, resulting in a classic buffer overflow condition classified under CWE-120. The overflow allows an attacker to overwrite adjacent stack or heap memory, including return addresses or function pointers, redirecting execution to attacker-controlled code. The vulnerability affects the older binary PowerPoint format (PPT), which has a complex record-based structure that creates numerous opportunities for parsing errors. The attack requires the victim to open the malicious file, but since PowerPoint presentations are commonly shared in business contexts, the social engineering barrier is relatively low.
Frequently Asked Questions
Is CVE-2010-2572 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2010-2572 to the Known Exploited Vulnerabilities catalog. The EPSS score of 74.7% in the 98th percentile indicates a high probability of ongoing exploitation through malicious PowerPoint files.
What products are affected by CVE-2010-2572?
CVE-2010-2572 affects Microsoft PowerPoint, particularly older versions that process the legacy PPT binary format. Organizations running Office 2003 or Office 2007 are most at risk and should upgrade to a currently supported version.
How do I fix CVE-2010-2572?
Apply the Microsoft security updates for PowerPoint and upgrade to a currently supported Office version. Enable Protected View for all externally received presentations and configure email gateways to scan PowerPoint attachments.
How severe is CVE-2010-2572?
CVE-2010-2572 is a severe buffer overflow vulnerability with an EPSS score in the 98th percentile, enabling remote code execution through crafted PowerPoint presentations. The commonality of PowerPoint files in business communication and the user-assisted attack vector make this vulnerability effective for targeted spear-phishing campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.