Yes. CISA added CVE-2010-2572 to its Known Exploited Vulnerabilities catalogue on 8 June 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution. Any organisation running the affected product should treat remediation as urgent.
What “exploited in the wild” means for CVE-2010-2572
For a vulnerability like CVE-2010-2572, the practical question is not whether the bug exists, but whether attackers are already using it. CISA’s KEV listing is the strongest operational signal that exploitation is not theoretical. That shifts the issue from routine patch hygiene to active exposure management, because exploitation can be occurring before you have time to validate every affected endpoint.
An exploited buffer overflow in Microsoft PowerPoint matters because the product is often opened through normal user workflows, including email attachments and shared files. Once an attacker can trigger remote code execution, the vulnerability becomes a delivery path for payloads, not just a crash condition. For vulnerability triage, that means you should treat any reachable PowerPoint exposure as high priority until you have confirmed containment.
Zero-Day and Exploited Vulnerabilities Guide is the most relevant internal starting point when a KEV-listed issue needs emergency triage, exploit-aware prioritisation, and post-patch validation.
Why this vulnerability is operationally urgent
The main operational issue is blast radius. A PowerPoint buffer overflow can become a foothold in user workstations, then a stepping stone into mailboxes, file shares, or higher-value systems if the compromised host has broader trust than it should. Even when the initial exploit lands on a single endpoint, the security consequence is often enterprise-wide because office documents are routinely exchanged across departments and external partners.
Because CISA only adds a vulnerability to KEV when there is reliable evidence of active exploitation, defenders should assume the exploit path is already known and likely weaponised. That means the priority is not to debate exploitability, but to confirm exposure, validate whether the vulnerable software is present, and move vulnerable systems into remediation or compensating control status as quickly as possible. If patching is delayed, exposure should be treated as a monitored exception, not a normal backlog item.
For broader triage context, the CISA Known Exploited Vulnerabilities Catalog is the authoritative source for KEV status and required action, while the NIST National Vulnerability Database is useful for correlating the record with technical metadata and downstream inventory work.
How to respond when patching cannot happen immediately
If immediate remediation is blocked by change windows, legacy compatibility, or operational dependencies, the next best move is to reduce exposure around the vulnerable application rather than hope the exploit is unlikely. In practice, that means tightening who can deliver or open untrusted PowerPoint files, isolating high-risk user groups, and watching for suspicious document handling or unexpected child processes launched from Office applications.
Where possible, remove the vulnerable software from internet-facing or externally reachable workflows, and treat email, collaboration platforms, and shared file ingress as the highest-risk paths. If the application is necessary for business operations, use interim controls that limit document origin, sandbox suspicious content, and block execution paths that an exploit would rely on. Temporary risk acceptance should be explicit, time-bound, and owned.
The NIST Cybersecurity Framework 2.0 is useful here because the response is not just patching, it is also identifying, protecting, detecting, responding, and recovering around a known exploited weakness. The FIRST EPSS resource can also help when you need probability-based prioritisation across a large backlog, especially if multiple vulnerabilities are competing for the same remediation window.
Risk and Threat Considerations
Active exploitation changes the threat model. A buffer overflow that allows remote code execution is attractive because it can turn a normal document into an initial access vector, often without requiring the user to do anything unusual beyond opening a file. Once that happens, attackers may use the endpoint for follow-on payload delivery, credential theft, or lateral movement if the host is not well segmented.
Failure mechanism: The vulnerable PowerPoint parsing path accepts crafted input that overflows memory and hands execution control to attacker-supplied code, which can then run in the user context or pivot into a larger intrusion chain.
Impact: The immediate impact is unauthorized code execution on an endpoint, but the practical impact can extend to broader compromise if the affected machine has access to mail, files, or administrative tooling.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification | This KEV issue requires identifying exposure to a known exploited vulnerability. |
| PR.IP-12 — Vulnerability Management Plan | Active exploitation makes coordinated vulnerability handling and exception tracking necessary. | |
| DE.CM-08 — Malicious Code Detected | Exploited document handling warrants monitoring for malicious activity indicators. | |
| Recommendation — Identify affected assets and prioritize remediation for the KEV-listed PowerPoint flaw. Apply a formal vulnerability workflow to patch, mitigate, or time-bound the exception. Tune detection to flag suspicious Office document execution and follow-on payload behavior. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | A confirmed exploited software flaw requires prompt remediation and tracking. |
| SI-4 — System Monitoring | Active exploitation demands monitoring for suspicious file-open and post-exploitation behavior. | |
| Recommendation — Remediate the vulnerable PowerPoint software and verify the fix was applied. Monitor for exploit indicators and unexpected processes spawned from Office applications. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation is a vulnerability management priority signal. |
| CIS-10 — Malware Defenses | Document-delivered exploitation commonly requires endpoint malware prevention and detection. | |
| Recommendation — Prioritize and remediate the exploited vulnerability ahead of routine backlog items. Block malicious Office content and inspect suspicious execution chains on endpoints. | ||
Practitioner Guidance
What to verify: Confirm whether PowerPoint is present on exposed endpoints, whether those systems can receive untrusted documents, and whether any protective controls already block malicious Office file delivery or execution. If you cannot prove the asset is out of scope, assume it is in scope.
Decision rule: If the vulnerable product is reachable on a business-critical endpoint, prioritize containment and patching over normal change sequencing. If patching must wait, isolate the asset, increase monitoring, and treat any suspicious document opening as a possible incident signal.
Practitioner takeaway: For KEV-listed vulnerabilities, the question is not whether exploitation is possible, but whether your environment can still be reached by the exploit path, and that should drive emergency remediation order.
Related resources from NHI Mgmt Group
- CVE-2010-2572 (Microsoft PowerPoint Buffer Overflow)
- Is CVE-2025-24993 (Microsoft Windows NTFS Heap-Based Buffer Overflow) being exploited in the wild?
- Is CVE-2013-1331 (Microsoft Office Buffer Overflow) being exploited in the wild?
- Is CVE-2025-20333 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow) being exploited in the wild?