CVE-2011-0092

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-02-10 · updated 2026-06-16
Weakness: CWE-94

Description

The LZW stream decompression functionality in ORMELEMS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 allows remote attackers to execute arbitrary code via a Visio file with a malformed VisioDocument stream that triggers an exception handler that accesses an object that has not been fully initialized, which triggers memory corruption, aka "Visio Object Memory Corruption Vulnerability."

Affected products

Microsoft Visio: 2002-sp2, 2003-sp3, 2007-sp2

References

http://osvdb.org/70828
http://secunia.com/advisories/43254
http://www.securityfocus.com/archive/1/516274/100/0/threaded
http://www.securityfocus.com/bid/46137
http://www.securitytracker.com/id?1025043
http://www.vupen.com/english/advisories/2011/0321
http://www.zerodayinitiative.com/advisories/ZDI-11-063/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-008
https://exchange.xforce.ibmcloud.com/vulnerabilities/64923
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12403
http://osvdb.org/70828
http://secunia.com/advisories/43254

Get alerted when CVE-2011-0092 or the next vulnerability affects your stack