CVE-2010-2739
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3,...
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
- Record
CVE-2010-2739- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
- Record
CVE-2010-2739- Updated
- 2026-11-02
EUVDEUVD-2010-2743 No score
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
- Record
EUVD-2010-2743- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8vc-4phr-q4j2 No score
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3,...
Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors.
- Record
GHSA-j8vc-4phr-q4j2- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows - 'win32k.sys' Driver 'CreateDIBPalette()' Local Buffer Overflow | 2010-08-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2739 is a high vulnerability (CVSS 7.2) in Microsoft Windows 7, published September 7, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.74%, the 89th percentile. No source names a fixed version.
References
secunia.com/advisories/40870
ragestorm.net/blogs?p=255
vupen.com/english/advisories/2010/2029
blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability.aspx
msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability
nvd.nist.gov/vuln/detail/CVE-2010-2739
github.com/advisories/GHSA-j8vc-4phr-q4j2