CVE-2010-0266
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of...
- Published
- Jul 14, 2010
- Updated
- Aug 7, 2024
- Assigning CNA
- microsoft
- Evidence observed
- Sep 20, 2010
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 98.9%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka "Microsoft Outlook SMB Attachment Vulnerability."
Sources
modules/exploits/windows/email/ms10_045_outlook_ref_only.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/email/ms10_045_outlook_ref_only.platform)
- verification: check_not_declared($.exploit_windows/email/ms10_045_outlook_ref_only.check)
modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
Metasploit Framework modulesDeclared conditions
- platform: Windows($.exploit_windows/email/ms10_045_outlook_ref_resolve.platform)
- verification: check_not_declared($.exploit_windows/email/ms10_045_outlook_ref_resolve.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.