CVE-2003-0347: Microsoft Office

High severity, CVSS 10.0. EPSS: 54.9% chance of exploitation in the next 30 days.

Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID parameter.

Affected products

• Microsoft Office: version 2000 only; version xp only
• Microsoft Project: version 2000 only; version 2002 only
• Microsoft Visio: version 2002 only
• Microsoft Visual Basic: version 5.0 only; version 6.2 only; version 6.3 only

Published 2003-10-20. Last modified 2026-06-16.