CVE-2010-0258 in the critical feed json
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offi…
published 2010-03-10 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-0289
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 61.0%
- EPSS 61.0% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 0
- none known
Summary
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended, aka "Microsoft Office Excel Sheet Object Type Confusion Vulnerability."
Patch / fix
Exploit prediction
60.95% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-843 Access of Resource Using Incompatible Type
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2010/ms10-017
vendor-advisory, patch
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=859
third-party-advisory, broken-link
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8545
vdb-entry, signature, broken-link
-
us-cert.gov
/cas/techalerts/TA10-068A.html
third-party-advisory, us-government-resource
-
securitytracker.com
/id?1023698
vdb-entry, broken-link, third-party-advisory
Sources
- CVE List CVE-2010-0258
- NVD CVE-2010-0258
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.