Publisher
Vendor:
First CVE: Sep 28, 2004 · Active for 21 years
43
Total CVEs
More Total CVEs than 97% of tracked products
2.7
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
8.9
Avg CVSS
Higher Avg CVSS than 83% of tracked products
4.7%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Publisher over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 28, 2004
21 years ago
Most Recent CVE
Sep 10, 2024
683 days ago
CVE Severity & Scoring
Publisher43 CVEs
95%
All CVEs352,708 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local8 (18.6%)
Network2 (4.7%)
Unknown33 (76.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (23.3%)
High0 (0.0%)
Unknown33 (76.7%)
User Interaction
None0 (0.0%)
Unknown33 (76.7%)
Required10 (23.3%)
Privileges Required
Low1 (2.3%)
High0 (0.0%)
None9 (20.9%)
Unknown33 (76.7%)
Top CVEs
Signals from CVEs in this product scope (43 CVEs).
43 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-0671HIGH Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code v | Feb 3, 2007 | 8.8 | 84 | YES | NO |
CVE-2004-0200HIGH Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via | Sep 28, 2004 | 9.3 | 68 | NO | YES |
CVE-2024-38226HIGH Microsoft Publisher Security Feature Bypass Vulnerability | Sep 10, 2024 | 7.3 | 65 | YES | NO |
CVE-2008-0102HIGH Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, related to invalid "memo | Feb 12, 2008 | 10.0 | 46 | NO | NO |
CVE-2006-0001HIGH Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflo | Sep 12, 2006 | 9.3 | 45 | NO | NO |
CVE-2011-3412HIGH Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect memory handling, aka "Pu | Dec 14, 2011 | 9.3 | 42 | NO | NO |
CVE-2007-1754HIGH PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arb | Jul 10, 2007 | 9.3 | 42 | NO | NO |
CVE-2011-3411HIGH Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher In | Dec 14, 2011 | 9.3 | 40 | NO | NO |
CVE-2011-3410HIGH Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect han | Dec 14, 2011 | 9.3 | 40 | NO | NO |
CVE-2008-0104HIGH Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, aka "Publisher Memory Co | Feb 12, 2008 | 9.3 | 40 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (43 CVEs).
CISA KEV
2 CVEs
4.7% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
2.3% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (43 CVEs).
Media Mentions
Signals from CVEs in this product scope (43 CVEs).
Top CNAs Publishing CVEs For Publisher
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2016 | 7 | 7.5 | 4.3% | 1 | 0 |
| 2013 | 4 | 8.4 | 6.7% | 0 | 0 |
| 2010 | 8 | 8.7 | 19.0% | 0 | 0 |
| 2007 | 14 | 9.0 | 21.2% | 0 | 0 |
| 2003 | 29 | 9.2 | 25.1% | 1 | 1 |
| 2002 | 13 | 8.8 | 26.9% | 1 | 1 |
| 2000 | 6 | 8.6 | 30.8% | 1 | 0 |