Shih-Hao Weng

The issue is related to a remote code execution vulnerability in the way Microsoft Word handles Word files with a specially crafted data structure. This could allow attackers to execute code via malformed data structures that trigger memory corruption. A specially crafted file might be included as an e-mail attachment or hosted on a malicious Web site, and an attacker could exploit the vulnerability by constructing such a file.

The issue allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption. A remote code execution vulnerability exists in the way Microsoft Word handles Word files with a specially crafted string. Such a specially crafted file might be included as an e-mail attachment or hosted on a malicious Web site. An attacker could exploit the issue by constructing a specially crafted Word file that could allow remote code execution.

A remote code execution issue exists and could be exploited when a file containing a malformed shape container is parsed. Such a file might be included in an e-mail attachment or hosted on a malicious web site. An attacker could exploit this by constructing a specially crafted PowerPoint file that could allow remote code execution.

A buffer overflow issue in Microsoft Word allows user-assisted attackers to execute arbitrary code via a malformed object pointer. This was originally reported for a zero-day attack. The issue enables remote code execution when a specially crafted Word file is used.

A buffer overflow issue in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.