CVE-2010-3970 | Netskope Threat Labs

Description

This detection identifies exploitation attempts targeting CVE-2010-3970, which has a UNKNOWN severity rating. Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote cyberattackers to execute arbitrary code via a crafted .MIC or unspecified Office document containing a thumbnail bitmap with a negative biClrUsed value, as reported by Moti and Xu Hao, aka Windows Shell Graphics Processing Overrun Vulnerability.

Stats

First seen: January 2022
Last seen: September 2026

CVEs

CVE-2010-3970

Alert name variants

Alert Name	Engine
Document-Office.Exploit.CVE-2010-3970	ATP Sandbox Adv. Heuristics
Win32.Exploit.CVE-2010-3970	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
FILE-OFFICE Microsoft Office thumbnail bitmap invalid biClrUsed attempt	IPS-SWG
PROTOCOL-IMAP Microsoft sizeddip section integer overflow	IPS-CFW

Related families

Microsoft

References

nvd.nist.gov