CVSS 9.3 CRITICAL Bulletin: MS10-087 Published: 2010-11-09

CVE-2010-3333: Microsoft Office RTF pFragments Stack Buffer Overflow

Technical intelligence and weaponization dossier for CVE-2010-3333. Documented exploitation across 3 active malware families totaling 1,470 analyzed telemetry samples.

Attributed Families

Sample Volume

1,470

CVSS Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2010-3333
Common Name / Bulletin	Microsoft Office RTF pFragments Stack Buffer Overflow (`MS10-087`)
CWE Classification	`CWE-119: Stack-based Buffer Overflow in mso.dll`
Affected Software & Versions	Microsoft Office XP, 2003, 2007, 2010
Technical Root Cause	Stack overflow in Microsoft Word while parsing the '\pfragments' drawing shape attribute inside RTF files, widely used in spearphishing by APTs.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.001` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2010-3333

Empirical catalog telemetry verifies that the following 3 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

3 families

Malware Family	Category	Catalog Samples	Operational Profile
darkkomet	Rat	`801`	DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Access Trojan (RAT) original...
cosmicduke	Infostealer	`408`	Backdoor:Win32/CosmicDuke (also tracked as Bot-Moog, TinyBaron, or Nemor) is an advanced cyber espionage platform developed and deployed by APT29 (Cozy Bear / R...
poison	Rat	`261`	Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cybe...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2010-3333 in enterprise intrusions and campaign toolkits:

APT29 — Attributed Threat Group / Campaign Operator
Cozy Bear — Attributed Threat Group / Campaign Operator
Russian SVR — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2010-3333 in enterprise networks:

Inbound email RTF files containing the keyword string '\pfragments' with hex array length exceeding 32,768 bytes.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Deploy MS10-087; enforce Office File Block policies for legacy RTF formats; deploy EDR memory exploit mitigation.

For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →

← Return to Vulnerability Matrix Directory (All 63 CVEs)