Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2013-1331 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Microsoft Office. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A buffer overflow vulnerability exists in Microsoft Office 2003 SP3 and Office 2011 for Mac due to improper memory allocation when processing crafted PNG image data embedded in Office documents. The flaw, tracked as CWE-120 and also known as the Office Buffer Overflow Vulnerability, affects document handling components in these specific Office versions.
Remote attackers can exploit the issue by delivering a malicious Office document containing specially crafted PNG data. Successful exploitation grants the ability to execute arbitrary code on the target system with the privileges of the logged-in user, provided the document is opened.
Microsoft security bulletin MS13-051 and US-CERT alert TA13-168A address the vulnerability and direct administrators to apply the corresponding patches. OVAL definitions are available to support detection of affected installations.
No information on observed in-the-wild exploitation is supplied in the source data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2013-1371
Vulnerability Data
Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."
- CWE(s)
- KEV Date Added
- 08 June 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.
Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.
Secure development practices directly enforce bounds checking and input validation that prevent classic buffer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.