CVE-2012-2524CWE-119

CVE-2012-2524

High · published August 15, 2012

CVSS v2.0
9.3
EPSS
20%
Percentile
97.5
In the wild
Unconfirmed
What it is

⚠️ A cleverly crafted CGM file can trigger memory corruption in Microsoft Office, letting attackers run wild! 🐾 Think of this as a restaurant where a chef unknowingly accepts a dish made with spoiled ingredients — the moment it gets served, the whole kitchen could go haywire! 🍽️ If an attacker successfully exploits this vulnerability, they could run arbitrary code on your system, which may lead to unauthorized access or even a denial of service. Imagine your productivity grinding to a halt as Office crashes spectacularly!

Put simply

Think of this as a restaurant where a chef unknowingly accepts a dish made with spoiled ingredients — the moment it gets served, the whole kitchen could go haywire! 🍽️ This vulnerability lies in how Microsoft Office processes these CGM files, allowing memory corruption that can be exploited to execute unauthorized commands or crash the software.

What to do

If an attacker successfully exploits this vulnerability, they could run arbitrary code on your system, which may lead to unauthorized access or even a denial of service. Imagine your productivity grinding to a halt as Office crashes spectacularly! To keep your systems safe, ensure that you apply the latest updates for Office 2007 and 2010. Regularly audit your software environment to mitigate risks associated with outdated versions. 🛡️ You've got this! Stay vigilant, keep your software updated, and you'll be a security hero in no time! 🌟

The record
Technical detail
CVSS v2.0
9.3 · HIGH
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v4.0
Not supplied
EPSS
0.20124 · 97.5th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2012-08-15T05:55Z
Affected products (3)
ProductVersionsFixed in
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
References (6)
EPSS history
Timeline
  • 15 AUG 01:00Z
    Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5