Software Engineering Institute

Microsoft Office applications fail to properly parse strings. When an Office document containing malformed string is opened with an Office application, system memory can be corrupted in a way that may allow an attacker to execute arbitrary code.

More information, including a list of affected Office applications, is available in Microsoft Security Bulletin MS06-038.

A remote, unauthenticated attacker may be able to execute arbitrary code.

Apply a patch from Microsoft
Microsoft addresses this vulnerability with the updates listed in Microsoft Security Bulletin MS06-038.

Do not access Office documents from untrusted sources

By only accessing Office documents, such as spreadsheets or Microsoft Word documents, from trusted or known sources, the chances of exploitation are reduced.