CVE-2009-0088

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.3CRITICAL
EPSS
63.0%
top 1.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Office Converter PackMicrosoft Office Word
Timeline
PublishedApr 15
Latest updateMay 2

Description

The WordPerfect 6.x Converter (WPFT632.CNV, 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file, related to an unspecified counter and control structures on the stack, aka "Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDmicrosoft/office_word2000, 2002+1

🔴Vulnerability Details

2
GHSA
GHSA-76m4-gvc2-6922: The WordPerfect 6↗2022-05-02
▶
CVEList
CVE-2009-0088: The WordPerfect 6↗2009-04-15
▶
CVE-2009-0088 (CRITICAL CVSS 9.3) | The WordPerfect 6.x Converter (WPFT | cvebase.io