CVE-2011-1982 in the critical feed json
Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, w…
published 2011-09-15 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1976
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 27.7%
- EPSS 27.7% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Office Uninitialized Object Pointer Vulnerability."
Exploit prediction
27.70% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2011/ms11-073
vendor-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12243
vdb-entry, signature
-
kb.cert.org
/vuls/id/909022
third-party-advisory, us-government-resource
-
us-cert.gov
/cas/techalerts/TA11-256A.html
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2011-1982
- NVD CVE-2011-1982
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.