---
id: "CVE-2013-1331"
kind: "vulnerability"
aliases: ["CVE-2013-1331"]
title: "Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary\u2026"
severity: "critical"
cvss: 9.3
epss: 0.79822
exploited: true
status: "open"
category: "package"
products: [{"name": "Microsoft Office", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft office", "fixed": [], "affected": "= 2003", "ecosystem": "vendor"}, {"name": "microsoft office", "fixed": [], "affected": "= 2011", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "microsoft-office", "package", "windows"]
not_affected_if: ["patched-office"]
published_at: "2013-06-12T03:29:57+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-1331", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-1331", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1331", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary…

Microsoft Office has a buffer overflow triggered by crafted PNG image data embedded in an Office document. An attacker who gets a user to open the document can run code on that user's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office affected ? fixed ?
- vendor:microsoft office affected = 2003 fixed ?
- vendor:microsoft office affected = 2011 fixed ?

## Fix

Apply Microsoft's security updates for Office per vendor instructions, as CISA requires; the specific bulletin and affected builds are not given in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-1331
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2013-1331
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2013-1331

## From the sources

Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_