CVE-2010-3964 — Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082, aka "Malformed Request Code Execution Vulnerability."

Back Back to CVE browser

HIGH

Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082, aka "Malformed Request Code Execution Vulnerability."

Published Dec 16, 2010

7.5

HIGH

CVSS 2.0

EPSS 94.20%

Description

Unrestricted file upload vulnerability in the Document Conversions Launcher Service in Microsoft Office SharePoint Server 2007 SP2, when the Document Conversions Load Balancer Service is enabled, allows remote attackers to execute arbitrary code via a crafted SOAP request to TCP port 8082, aka "Malformed Request Code Execution Vulnerability."

Affected products

Remediation

No remediation recorded yet.

Metrics

94.20% 0.94201

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.94201

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (46 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	94.20% (0.94201)	99.85th	v5 (v2026.06.15)
Jun 15, 2026	93.92% (0.93916)	99.83th	v5 (v2026.06.15)
Mar 4, 2026	90.60% (0.90600)	99.60th	v4 (v2025.03.14)
Mar 1, 2026	87.98% (0.87983)	99.48th	v4 (v2025.03.14)
Feb 4, 2026	90.60% (0.90600)	99.60th	v4 (v2025.03.14)
Feb 1, 2026	87.98% (0.87983)	99.47th	v4 (v2025.03.14)
Jan 4, 2026	90.60% (0.90600)	99.59th	v4 (v2025.03.14)
Jan 1, 2026	87.98% (0.87983)	99.46th	v4 (v2025.03.14)
Dec 4, 2025	90.11% (0.90105)	99.55th	v4 (v2025.03.14)
Dec 1, 2025	87.16% (0.87156)	99.42th	v4 (v2025.03.14)
Nov 4, 2025	90.11% (0.90105)	99.55th	v4 (v2025.03.14)
Nov 1, 2025	87.16% (0.87156)	99.42th	v4 (v2025.03.14)
Oct 4, 2025	90.11% (0.90105)	99.56th	v4 (v2025.03.14)
Oct 1, 2025	87.16% (0.87156)	99.42th	v4 (v2025.03.14)
Sep 4, 2025	90.11% (0.90105)	99.57th	v4 (v2025.03.14)
Sep 1, 2025	87.16% (0.87156)	99.42th	v4 (v2025.03.14)
Aug 4, 2025	90.11% (0.90105)	99.56th	v4 (v2025.03.14)
Aug 1, 2025	87.16% (0.87156)	99.42th	v4 (v2025.03.14)
Jul 5, 2025	90.11% (0.90105)	99.55th	v4 (v2025.03.14)
Jul 1, 2025	87.16% (0.87156)	99.41th	v4 (v2025.03.14)
Jun 4, 2025	90.11% (0.90105)	99.56th	v4 (v2025.03.14)
Jun 1, 2025	87.16% (0.87156)	99.41th	v4 (v2025.03.14)
May 5, 2025	90.11% (0.90105)	99.55th	v4 (v2025.03.14)
Apr 30, 2025	87.16% (0.87156)	99.38th	v4 (v2025.03.14)
Apr 17, 2025	90.11% (0.90105)	99.54th	v4 (v2025.03.14)
Apr 16, 2025	87.16% (0.87156)	99.38th	v4 (v2025.03.14)
Apr 12, 2025	90.11% (0.90105)	99.58th	v4 (v2025.03.14)
Apr 11, 2025	87.16% (0.87156)	99.41th	v4 (v2025.03.14)
Apr 8, 2025	90.11% (0.90105)	99.57th	v4 (v2025.03.14)
Apr 7, 2025	87.16% (0.87156)	99.41th	v4 (v2025.03.14)
Apr 3, 2025	90.11% (0.90105)	99.57th	v4 (v2025.03.14)
Apr 2, 2025	87.16% (0.87156)	99.41th	v4 (v2025.03.14)
Mar 31, 2025	90.11% (0.90105)	99.57th	v4 (v2025.03.14)
Mar 30, 2025	87.16% (0.87156)	99.40th	v4 (v2025.03.14)
Mar 17, 2025	90.11% (0.90105)	99.57th	v4 (v2025.03.14)
Dec 12, 2024	97.11% (0.97108)	99.83th	v3 (v2023.03.01)
Jun 26, 2024	97.07% (0.97067)	99.77th	v3 (v2023.03.01)
May 13, 2024	97.03% (0.97027)	99.75th	v3 (v2023.03.01)
Jan 2, 2024	97.06% (0.97060)	99.71th	v3 (v2023.03.01)
Aug 6, 2023	97.03% (0.97031)	99.63th	v3 (v2023.03.01)
Jun 16, 2023	97.07% (0.97069)	99.63th	v3 (v2023.03.01)
Apr 24, 2023	97.12% (0.97116)	99.62th	v3 (v2023.03.01)
Mar 7, 2023	97.10% (0.97099)	99.58th	v3 (v2023.03.01)
Mar 6, 2023	92.17% (0.92173)	99.90th	v2 (v2022.01.01)
Feb 5, 2022	92.17% (0.92173)	99.89th	v2 (v2022.01.01)
Feb 4, 2022	90.15% (0.90154)	99.81th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (9)

http://osvdb.org/69817
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/42631
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/45264
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1024886
vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA10-348A.html
third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2010/3226
vdb-entryx_refsource_VUPENVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-287/
x_refsource_MISC
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-104
vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11737
vdb-entrysignaturex_refsource_OVAL

Link	Providers	Tags
http://osvdb.org/69817		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/42631		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/45264		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1024886		vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA10-348A.html		third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2010/3226		vdb-entryx_refsource_VUPENVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-287/		x_refsource_MISC
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-104		vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11737		vdb-entrysignaturex_refsource_OVAL

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Dec 16, 2010

Updated Aug 7, 2024

Reserved Oct 14, 2010

Link CVE-2010-3964

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2010-3964

Red Hat

Severity n/a

Public date n/a

Links CVE-2010-3964