CVE-2013-1328: Microsoft Publisher 2003 SP3, 2007 SP3, and 2010 SP1 allows remote attackers to execute arbitrary code via...

Security readout for executives and security teams

CVE-2013-1328 is a remote code execution flaw in Microsoft Publisher. A malicious Publisher file could cause vulnerable Publisher versions to run attacker-controlled code if opened. Business urgency is highest for environments still using Publisher 2003 SP3, 2007 SP3, or 2010 SP1, especially where users receive external documents. Exposure is likely limited to endpoints with the named Microsoft Publisher versions installed and users who can open Publisher files from email, web downloads, or file shares. The supplied CPE data is incomplete, so inventory validation is important. Treat this as a legacy Office document risk. It is not supported by provided evidence of active exploitation, but arbitrary code execution through user-opened files can create meaningful compromise risk in unpatched environments. Mitigation focus: Review and apply Microsoft MS13-042 guidance for affected Publisher installations.; Remove or upgrade vulnerable Publisher versions where business use is no longer required.; Restrict Publisher file handling from untrusted email and web sources..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.