CVE-2010-3148

CVE-2010-3148 is a critical-severity vulnerability in Microsoft Visio with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 14% places it in the 96th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

Untrusted search path vulnerability in Microsoft Visio 2003 SP3 allows local users to gain privileges via a Trojan horse mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .vsd, .vdx, .vst, or .vtx file, aka "Microsoft Visio Insecure Library Loading Vulnerability."

Frequently asked questions

What is CVE-2010-3148?
Untrusted search path vulnerability in Microsoft Visio 2003 SP3 allows local users to gain privileges via a Trojan horse mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .vsd, .vdx, .vst, or .vtx file, aka "Microsoft Visio Insecure Library Loading Vulnerability."
How severe is CVE-2010-3148?
CVE-2010-3148 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2010-3148 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 14% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2010-3148?
CVE-2010-3148 affects Microsoft Visio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2010-3148?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2010-3148 published?
CVE-2010-3148 was published on 2010-08-27 and last updated on 2026-06-16.

References

Affected products (1)

More vulnerabilities in Microsoft Visio

All CVEs affecting Microsoft Visio →