CVE-2009-2493
published 2009-07-29CVE-2009-2493: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold…
PriorityP181high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
37.90%
98.4th percentile
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_c | — | — |
| microsoft | visual_c | — | — |
| microsoft | visual_studio | — | — |
| microsoft | visual_studio | — | — |
| microsoft | visual_studio | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft Windows ActiveX Controls ATL OleLoadFromStream access control (MS09-055 / Nessus ID 43822)
vuldb·2026-05-27·CVSS 8.8
CVE-2009-2493 [HIGH] Microsoft Windows ActiveX Controls ATL OleLoadFromStream access control (MS09-055 / Nessus ID 43822)
A vulnerability, which was classified as very critical, was found in Microsoft Windows. Affected by this vulnerability is the function OleLoadFromStream of the component ActiveX Controls ATL. Executing a manipulation can lead to improper access controls.
This vulnerability appears as CVE-2009-2493. The attack may be performed from remote. In addition, an exploit is available.
You should upgrade the affected component.
GHSA
GHSA-xrpm-74v3-f6fq: The Active Template Library (ATL) in Microsoft Visual Studio
ghsa_unreviewed·2022-05-02
CVE-2009-2493 [HIGH] GHSA-xrpm-74v3-f6fq: The Active Template Library (ATL) in Microsoft Visual Studio
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
VulnCheck
Microsoft Active Template Library (ATL) COM Initialization Vulnerability
vulncheck·2009·CVSS 9.3
CVE-2009-2493 [CRITICAL] Microsoft Active Template Library (ATL) COM Initialization Vulnerability
Microsoft Active Template Library (ATL) COM Initialization Vulnerability
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) component or (2) control, related to ATL headers and bypassing security policies, aka "ATL COM Initialization Vulnerability."
Affected: Microsoft visual_c\+\+
Required Action: Apply remediations or mitigations per vendor instructions or discontinue
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspxhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.htmlhttp://marc.info/?l=bugtraq&m=126592505426855&w=2http://secunia.com/advisories/35967http://secunia.com/advisories/36187http://secunia.com/advisories/36374http://secunia.com/advisories/36746http://secunia.com/advisories/38568http://secunia.com/advisories/41818http://sunsolve.sun.com/search/document.do?assetkey=1-66-264648-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020775.1-1http://www.adobe.com/support/security/advisories/apsa09-04.htmlhttp://www.adobe.com/support/security/bulletins/apsb09-10.htmlhttp://www.adobe.com/support/security/bulletins/apsb09-11.htmlhttp://www.adobe.com/support/security/bulletins/apsb09-13.htmlhttp://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1http://www.openoffice.org/security/cves/CVE-2009-2493.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-195A.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-286A.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-342A.htmlhttp://www.vupen.com/english/advisories/2009/2034http://www.vupen.com/english/advisories/2009/2232http://www.vupen.com/english/advisories/2010/0366https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-055https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-072https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6245https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6304https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6421https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6473https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6621https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6716http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspxhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.htmlhttp://marc.info/?l=bugtraq&m=126592505426855&w=2http://secunia.com/advisories/35967http://secunia.com/advisories/36187http://secunia.com/advisories/36374http://secunia.com/advisories/36746http://secunia.com/advisories/38568http://secunia.com/advisories/41818http://sunsolve.sun.com/search/document.do?assetkey=1-66-264648-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020775.1-1http://www.adobe.com/support/security/advisories/apsa09-04.htmlhttp://www.adobe.com/support/security/bulletins/apsb09-10.htmlhttp://www.adobe.com/support/security/bulletins/apsb09-11.htmlhttp://www.adobe.com/support/security/bulletins/apsb09-13.htmlhttp://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1http://www.openoffice.org/security/cves/CVE-2009-2493.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-195A.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-286A.htmlhttp://www.us-cert.gov/cas/techalerts/TA09-342A.htmlhttp://www.vupen.com/english/advisories/2009/2034http://www.vupen.com/english/advisories/2009/2232http://www.vupen.com/english/advisories/2010/0366https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-055https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-072https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6245https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6304https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6421https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6473https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6621https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6716
2009-07-29
Published
Exploited in the wild