← All detection heuristics · CVE
critical
CVE exact
CVE_2011_0105
What it means
Excel's shared-string index table (EXTSST) declares far more entries than the workbook's string count allows — the CVE-2011-0105 memory-corruption shape.
Why it fires
Microsoft Excel (MS11-021) rebuilds the shared-string index from an EXTSST record whose ISSTINF entry count must equal ceil(cstUnique / Dsst) taken from the preceding SST record. An EXTSST declaring far more entries drives a copy with an attacker-controlled length and source — the documented CVE-2011-0105 data-initialization memory-corruption primitive, where the over-declared array doubles as the heap-spray / pointer table — achieving code execution from a crafted .xls.
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118