VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 07:44 UTC

CVE-2010-3333

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF St…

Read full description

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.6/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.8: +1.17
Fresh EPSS: 89.39%: +0.45

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Bitdefender

Press · 13 Nov 2024, 23:36 · Bitdefender Blocks .rtf Exploit - Bitdefender

Google Cloud

Press · 20 May 2016, 07:00 · How RTF malware evades static signature-based detection - Google Cloud

The Citizen Lab

Press · 15 Jun 2015, 07:00 · Targeted Attacks against Tibetan and Hong Kong Groups Exploiting CVE-2014-4114 - The Citizen Lab

Google Cloud

Press · 01 Apr 2015, 07:00 · Microsoft Word Intruder & MWISTAT | Microsoft Word Exploit Kit - Google Cloud

McAfee

Press · 03 Apr 2014, 07:00 · RTF Attack Takes Advantage of Multiple Exploits - McAfee

See all 10 source documents

WeLiveSecurity

Press · 24 May 2013, 07:00 · Tax Returns: Slovakian Spyware Campaign - WeLiveSecurity

Securelist

Press · 17 Jan 2013, 08:00 · “Red October”. Detailed Malware Description 1. First Stage of Attack - Securelist

Cisco Blogs

Press · 15 Jan 2013, 08:00 · Red October in January: The Cyber Espionage Era - Cisco Blogs

Dice

Press · 14 Jan 2013, 08:00 · The Hunt for Red October - Dice

Krebs on Security

Press · 25 Dec 2010, 08:00 · Carders.cc, Backtrack-linux.org and Exploit-db.org Hacked - Krebs on Security

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:11). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence

exploitdb #16686 2011-03-04
exploitdb #17474 2011-07-03
exploitdb #18334 2012-01-08
exploitdb #24526 2013-02-20

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.8; EPSS 89.4%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: local access, no prior privileges, user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:25.923231+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

10 Nov 2010, 01:00

First press mention

25 Dec 2010, 08:00

Added to the CISA KEV catalog

03 Mar 2022, 00:00

Latest press mention

13 Nov 2024, 23:36

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

4 repositories