CVE-2009-3127

CWE-94 — Code Injection3 documents3 sources
Severity
9.3CRITICAL
EPSS
60.9%
top 1.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Compatibility Pack Word Excel PowerpointMicrosoft ExcelMicrosoft Excel Viewer+1 more
Timeline
PublishedNov 11
Latest updateMay 2

Description

Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Cache Memory Corruption Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmicrosoft/excel2002, 2003, 2007+2
▶NVDmicrosoft/office2004, 2008+1

🔴Vulnerability Details

2
GHSA
GHSA-mvcm-4jxr-w697: Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 d↗2022-05-02
▶
CVEList
CVE-2009-3127: Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 d↗2009-11-11
▶
CVE-2009-3127 (CRITICAL CVSS 9.3) | Microsoft Office Excel 2002 SP3 and | cvebase.io