{"id":"CVE-2010-2572","kind":"vulnerability","aliases":["CVE-2010-2572"],"related":[],"title":"Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via…","description":"Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka \"PowerPoint Parsing Buffer Overflow Vulnerability.\"","summary":"Microsoft PowerPoint has a buffer overflow that lets a crafted presentation file run code on the machine that opens it. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":0.58646,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Microsoft PowerPoint","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft powerpoint","fixed":[],"affected":"= 2002","ecosystem":"vendor"},{"name":"microsoft powerpoint","fixed":[],"affected":"= 2003","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-office","package","powerpoint","windows"],"not_affected_if":["patched-office"],"how_to_check":"Check the installed PowerPoint version against Microsoft's 2010 security bulletin for this CVE; the sources do not give a file or command.","fix":"Apply the Microsoft security update for this CVE per vendor instructions (CISA KEV required action); the exact patch name is not in the sources.","status":"open","published_at":"2010-11-10T03:00:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:51+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:12:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for this CVE per vendor instructions (CISA KEV required action); the exact patch name is not in the sources.\nunknown","reach":"local","impact":"high","summary":"Microsoft PowerPoint has a buffer overflow that lets a crafted presentation file run code on the machine that opens it. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["powerpoint","windows","microsoft-office"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the machine after a user opens a malicious file.","analyst_note":"Find the Microsoft security bulletin for CVE-2010-2572 and the exact fixed PowerPoint build; sources give no version or patch detail.","how_to_check":"Check the installed PowerPoint version against Microsoft's 2010 security bulletin for this CVE; the sources do not give a file or command.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["patched-office"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2823,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2010':20A,23A '-2572':21A,24A '2002':6A,72C '2003':9A,75C '95':88C 'activ':62B 'aka':90C 'allow':11A,77C 'arbitrari':16A,82C 'attack':13A,79C 'buffer':1A,42B,67C,93C 'cisa':58B 'code':17A,51B,83C 'craft':47B,86C 'cve':19A,22A 'document':89C 'execut':15A,81C 'exploit':31B,63B 'file':49B 'let':45B 'list':59B 'machin':54B 'microsoft':4A,25A,27A,29A,33B,38B,70C 'microsoft-offic':32B 'offic':34B 'open':56B 'overflow':2A,43B,68C,94C 'packag':35B 'pars':92C 'powerpoint':5A,26A,28A,30A,36B,39B,71C,87C,91C 'present':48B 'remot':12A,78C 'run':50B 'sp3':7A,10A,73C,76C 'via':18A,84C 'vulner':95C 'wild':66B 'window':37B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-11-10T03:00:01+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-2572","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-2572","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2010-2572","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-2572","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-2572","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2572","severity":null,"published_at":"2010-11-10T03:00:01+00:00","modified_at":"2026-06-16T23:21:00+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}