Zero-Day & Known Exploit Signature • QuickSand v2.3.0

Detecting CVE-2010-0188 in Malicious Documents & Streams

Summary: pdf.exploit using TIFF overflow CVE-2010-0188. QuickSand unpacks nested container streams (OLE2, OOXML, RTF, PDF filter chains, and archives) in memory to detect CVE-2010-0188 payloads in <50ms.

CVE-2010-0188 Vulnerability Identifier

T1203, T1204.002 MITRE ATT&CK Technique

PDF Target Stream Vector

QuickSand YARA Signatures for CVE-2010-0188

YARA Rule Identifier	Stream Detection Description	MITRE ATT&CK	Engine Module	Severity
`pdf_exploit_using_TIFF_overflow_CVE_2010_0188`	pdf.exploit using TIFF overflow CVE-2010-0188	T1203, T1204.002	PDF	5/10
`suspicious_string_TIFF_overflow_exploit_tif_name_CVE_2010_0188`	suspicious.string TIFF overflow exploit.tif name CVE-2010-0188	T1203, T1204.002	PDF	5/10
`suspicious_string_base_64_nop_sled_used_in_TIFF_overflow_CVE_2010_0188`	suspicious.string base 64 nop sled used in TIFF overflow CVE-2010-0188	T1203, T1204.002	PDF	5/10
`pdf_exploit_TIFF_overflow_CVE_2010_0188`	pdf.exploit TIFF overflow CVE-2010-0188	T1203, T1204.002	PDF	10/10

Scan Files for CVE-2010-0188 via REST API (<100ms)

Block weaponized uploads exploiting CVE-2010-0188 in your web app, S3/GCS bucket, or SOAR phishing workflow:

curl -X POST "https://malwaretracker-912661936520.europe-west1.run.app/v1/scan?store=false" \
  -H "X-API-Key: mt_live_YOUR_API_KEY" \
  -F "file=@untrusted_document.doc"

Get Free API Key (1,000 Scans/Mo) → Scan a File Online Now

Detecting CVE-2010-0188 in Malicious Documents & Streams

QuickSand YARA Signatures for CVE-2010-0188

Scan Files for CVE-2010-0188 via REST API (<100ms)

Related Document Exploit CVEs Detected by QuickSand