Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Microsoft Publisher 2003 SP3 can run malicious code

CVE-2013-1317 · published 13 years ago
Summary

Microsoft Publisher 2003 with Service Pack 3 can be tricked by a specially crafted Publisher file to run any program the attacker chooses. This happens because the program miscalculates how much memory to allocate, leading to an overflow. Apply the latest security update from Microsoft or stop opening untrusted Publisher files.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft publisher 2003
cpe:2.3:a:microsoft:publisher:2003:sp3:*:*:*:*:*:*
Original advisory text
Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation, aka "Publisher...
Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation, aka "Publisher Integer Overflow Vulnerability."
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
21% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published15 May 2013
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2013-1317 · NVD
Track software like this
Free during beta