CVE-2002-1338: The Load method in the Chart component of Office Web Components (OWC) 9 and 10 generates an exception when...

Security readout for executives and security teams

CVE-2002-1338 is an old information-disclosure issue in the Chart component of Microsoft Office Web Components 9 and 10. A remote web attacker could use error behavior to learn whether specific local files exist on a user’s machine. The bundle does not show code execution, data theft beyond file-existence probing, or active exploitation. Exposure is most likely on legacy workstations or applications that still install and allow OWC 9 or 10 in browser-accessible contexts. Modern exposure cannot be confirmed from the bundle. Treat this as a legacy exposure cleanup item unless OWC 9 or 10 remains in active use on sensitive workstations. Business urgency rises where old browser components are still allowed to process untrusted web content. Mitigation focus: Inventory endpoints and legacy apps for OWC 9 or 10 usage.; Check Microsoft or vendor guidance for supported remediation.; Retire or isolate systems requiring OWC 9 or 10..

Prepared

Jul 1, 2026, 06:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.