CVE-2010-3955: pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 does not properly perform arr...

Security readout for executives and security teams

This vulnerability affects Microsoft Publisher 2002 SP3 when it processes a malicious Publisher file using an old file format. A successful attack could let an attacker run code on the victim’s system. Business risk is concentrated in legacy endpoints that still open Publisher files from email, web downloads, or shared storage. Exposure is most likely where Microsoft Publisher 2002 SP3 is installed and users can open untrusted or externally supplied Publisher files. The provided OVAL reference suggests detection content exists, but the bundle does not include full platform coverage details. Treat this as a legacy software risk with high impact but unclear current exploitation. Prioritize confirming whether Publisher 2002 SP3 exists in the environment, then patch, remove, or isolate affected systems that handle external documents. Mitigation focus: Apply Microsoft guidance and updates from MS10-103 for affected Publisher installations.; Inventory systems running Microsoft Publisher 2002 SP3 or pubconv.dll.; Restrict opening Publisher files from untrusted sources on legacy systems..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.