CVE-2003-0347

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 54.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2003-10-20 · updated 2026-06-16

Description

Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID parameter.

Affected products

Microsoft Office: 2000, 2000-sp2, 2000-sp3, xp, xp-sp1, xp-sp2
Microsoft Project: 2000, 2002
Microsoft Visio: 2002
Microsoft Visual Basic: 5.0, 6.2, 6.3

References

http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0093.html
http://marc.info/?l=bugtraq&m=106262077829157&w=2
http://secunia.com/advisories/9666
http://www.kb.cert.org/vuls/id/804780
http://www.securityfocus.com/bid/8534
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-037
http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0093.html
http://marc.info/?l=bugtraq&m=106262077829157&w=2
http://secunia.com/advisories/9666
http://www.kb.cert.org/vuls/id/804780
http://www.securityfocus.com/bid/8534
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-037

Get alerted when CVE-2003-0347 or the next vulnerability affects your stack