CVE-2012-0167

Published: May 9, 2012Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in the Office GDI+ library in Microsoft Office 2003 SP3 and 2007 SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted EMF image in an Office document, aka "GDI+ Heap Overflow Vulnerability."

Affected (3)

Products: Microsoft: Office

Microsoft

1 product

Office

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2003 sp3
Microsoft Office	Version 2007 sp2
Microsoft Office	Version 2007 sp3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://secunia.com/advisories/49121

Source: secure@microsoft.com

http://www.securityfocus.com/bid/53351

Source: secure@microsoft.com

http://www.securitytracker.com/id?1027038

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA12-129A.html

Source: secure@microsoft.com

US Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034

Source: secure@microsoft.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/75126

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15628

Source: secure@microsoft.com

http://secunia.com/advisories/49121