CVE-2010-3954: Microsoft Publisher 2002 SP3, 2003 SP3, and 2010 allows remote attackers to execute arbitrary code or cause...

Security readout for executives and security teams

This is an old Microsoft Publisher file-parsing vulnerability. A malicious Publisher file could crash the application or let an attacker run code on a user’s machine. The business risk is highest where legacy Publisher 2002 SP3, 2003 SP3, or 2010 remains installed and users can receive or open untrusted Publisher files. Exposure is likely limited to endpoints with Microsoft Publisher 2002 SP3, Publisher 2003 SP3, or Publisher 2010 installed, especially where email, web downloads, or shared drives deliver Publisher files from outside trusted workflows. Prioritize remediation where legacy Microsoft Office software remains in use. The vulnerability can enable code execution from a malicious document, but the provided sources do not show current exploitation. Treat as a legacy endpoint hygiene and document-handling risk. Mitigation focus: Review and apply Microsoft MS10-103 guidance for affected Publisher versions.; Inventory endpoints for Publisher 2002 SP3, 2003 SP3, and 2010.; Treat Publisher files from unknown sources as unsafe until systems are remediated..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.