CVE-2010-2570: Heap-based buffer overflow in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3...

Security readout for executives and security teams

A malicious Publisher document using an old format can corrupt memory in Microsoft Publisher’s converter component. If a user opens the file, the attacker could run code as that user. This is most urgent where legacy Publisher or Office installations still open untrusted .pub files. Exposure is likely limited to systems with the listed legacy Publisher versions installed and users who can receive or open Publisher files. Environments that block Publisher attachments or have removed old Office components have lower exposure. Prioritize remediation if legacy Microsoft Publisher remains in production or handles external documents. The business risk is code execution from a malicious file, but urgency is lower where Publisher is absent, patched, or blocked from untrusted content. Mitigation focus: Review and apply Microsoft MS10-103 guidance for affected Publisher versions.; Remove or upgrade unsupported Publisher and Office installations where possible.; Restrict inbound Publisher files from email and web downloads..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.