CVE-2009-3128

CWE-94 — Code Injection3 documents3 sources
Severity
9.3CRITICAL
EPSS
54.9%
top 1.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Compatibility Pack Word Excel PowerpointMicrosoft ExcelMicrosoft Excel Viewer+1 more
Timeline
PublishedNov 11
Latest updateMay 2

Description

Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmicrosoft/excel2002, 2003, 2007+2
▶NVDmicrosoft/office2004, 2008+1

🔴Vulnerability Details

2
GHSA
GHSA-4wf2-8957-vf9x: Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote att↗2022-05-02
▶
CVEList
CVE-2009-3128: Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote att↗2009-11-11
▶
CVE-2009-3128 (CRITICAL CVSS 9.3) | Microsoft Office Excel 2002 SP3 and | cvebase.io