Integer Overflow Vulnerability in Microsoft Office Products

CVE-2009-2506

What is CVE-2009-2506?

An integer overflow vulnerability exists in the text converters of Microsoft Office Word and related applications, enabling remote attackers to execute arbitrary code. By crafting a malicious DOC file that contains an invalid number of property names in the DocumentSummaryInformation stream, an attacker can trigger a heap-based buffer overflow. This can be exploited remotely, potentially impacting users who open such files in Microsoft Office Word 2002 SP3, 2003 SP3, Works 8.5, and WordPad, compromising the confidentiality and integrity of user systems.

References