⚠ Actively exploited
Added to CISA KEV on 2022-06-08. Federal agencies required to patch by 2022-06-22. Required action: Apply updates per vendor instructions..

CVE-2009-0557

CWE-94 — Code Injection5 documents5 sources
Severity
7.8HIGH
EPSS
86.4%
top 0.59%
CISA KEV
KEV
Added 2022-06-08
Due 2022-06-22
Exploit
Exploited in wild
Active exploitation observed
Affected products
4
Microsoft OfficeMicrosoft Office Compatibility PackMicrosoft Office Excel Viewer+1 more
Timeline
PublishedJun 10
KEV addedJun 8
KEV dueJun 22
CISA Required Action: Apply updates per vendor instructions.

Description

Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruptio…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmicrosoft/office6 versions+5

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-fmc6-x6ww-78h8: Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP↗2022-05-02
▶
CVEList
CVE-2009-0557: Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP↗2009-06-10
▶
VulnCheck
Microsoft Office Object Record Corruption Vulnerability↗2009
▶

📋Vendor Advisories

1
CISA
Microsoft Office Object Record Corruption Vulnerability↗2022-06-08
▶
CVE-2009-0557 (HIGH CVSS 7.8) | Excel in Microsoft Office 2000 SP3 | cvebase.io