CVE-2011-0977

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 32.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-02-10 · updated 2026-06-16
Weakness: CWE-399

Description

Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format, aka "Microsoft Office Graphic Object Dereferencing Vulnerability."

Affected products

Microsoft Excel 2013 Service Pack 1: 2007

References

http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft
http://secunia.com/advisories/43216
http://secunia.com/advisories/44015
http://www.securitytracker.com/id?1025343
http://www.us-cert.gov/cas/techalerts/TA11-102A.html
http://www.vupen.com/english/advisories/2011/0942
http://zerodayinitiative.com/advisories/ZDI-11-043/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-023
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12339
http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft
http://secunia.com/advisories/43216
http://secunia.com/advisories/44015

Get alerted when CVE-2011-0977 or the next vulnerability affects your stack