⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2009-0238

CWE-94 — Code Injection6 documents5 sources
Severity
9.3CRITICAL
EPSS
57.2%
top 1.85%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
5
Microsoft ExcelMicrosoft OfficeMicrosoft Office Compatibility Pack+2 more
Timeline
PublishedFeb 25
Latest updateMay 2

Description

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages5 packages

▶NVDmicrosoft/office_excel4 versions+3
▶NVDmicrosoft/excel2004

🔴Vulnerability Details

3
GHSA
GHSA-qw7j-w352-g8m7: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, a↗2022-05-02
▶
CVEList
CVE-2009-0238: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, a↗2009-02-25
▶
VulnCheck
Microsoft Excel Improper Control of Generation of Code ('Code Injection')↗2009
▶

🕵️Threat Intelligence

2
Talos
Rule release for today - February 27th 2009↗2009-02-27
▶
Talos
Rule release for today - February 27th 2009↗2009-02-27
▶
CVE-2009-0238 (CRITICAL CVSS 9.3) | Microsoft Office Excel 2000 SP3 | cvebase.io