Microsoft Office Project Parser PropList Mismatched PID Code Execution (SMTP UUEncode)

Strike ID:
E09-07407
CVSS:
9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
False Positive:
f
Variants:
1
Year:
2009

Description

This strike exploits a vulnerability in Microsoft Office Project's file parser when it parses a file containing a Properties Stream List where one of the properties is an Odf9 type and does not have a specific PID value associated with the type. This causes the use of an uninitialized variable, resulting in a read access violation by the CDoc9Ser::ReadUidValue function when a value is attempted to be read using the uninitialized variable. In some circumstances, this error can provide an opportunity for arbitrary code execution.

CVE