RCE in Microsoft Excel Viewer
CVE-2009-2528
GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.205 (97.3th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Excel_viewer — versions 2003
- Microsoft Expression_web — versions 2
- Microsoft Forefront_client_security — versions 1.0
- Microsoft Internet_explorer — versions 6
- Microsoft .Net_framework — versions 1.1, 2.0
- Microsoft Office — versions 2003, 2007, xp
- Microsoft Office_compatibility_pack — versions 2007
- Microsoft Office_excel_viewer
- Microsoft Office_groove — versions 2007
- Microsoft Office_powerpoint_viewer — versions 2007
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)
Frequently asked questions
- What is CVE-2009-2528?
- CVE-2009-2528 is a vulnerability in Microsoft Excel Viewer, classified under Code Injection. Published 2009-10-14.
- Is CVE-2009-2528 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.