Loading vulnerability…
CVE-2010-3333 is a stack-based buffer overflow in Microsoft Office's handling of crafted Rich Text Format (RTF) content. A specially crafted RTF document can trigger memory corruption during parsing, allowing an attacker to execute arbitrary code in the context of the user who opens the file. Affected products include Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac. The vulnerability is commonly referred to as the RTF Stack Buffer Overflow Vulnerability and was addressed by Microsoft in MS10-087.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a single Metasploit module targeting the MS10-087 vulnerability (CVE-2010-3333) in Microsoft Word's RTF parser. The exploit leverages a stack-based buffer overflow in the handling of the 'pFragments' shape property within RTF files. The module generates a malicious RTF file (default name: msf.rtf) that, when opened in a vulnerable version of Microsoft Word (Office 2003, 2007, 2010, or XP prior to the MS10-087 patch), allows for arbitrary code execution with the privileges of the user. The exploit is highly weaponized, supporting customizable payloads via the Metasploit framework. The attack vector is user-assisted, requiring the victim to open the crafted RTF file. The module is well-documented, specifying multiple Office versions and platforms as targets, and includes references to the original vulnerability disclosure. No network endpoints are involved; the primary fingerprintable artifact is the malicious RTF file itself.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft Office RTF stack-based buffer overflow vulnerability that allows remote code execution via crafted RTF data and was used to deliver Hacking Team RCS malware against Ahmed Mansoor.
A Microsoft Office RTF parsing vulnerability used in a malicious document to install Hacking Team RCS against Ahmed Mansoor.
A well-known vulnerability used in document-based exploit lures in espionage campaigns targeting Tibetan groups.
An old Microsoft Office/RTF-handling vulnerability used by Aoqin Dragon in weaponized lure documents for initial compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.