RCE in Microsoft Compatibility_pack_word_excel_powerpoint
CVE-2009-3128
Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "E…
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.249 (97.7th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Compatibility_pack_word_excel_powerpoint — versions 2007
- Microsoft Excel — versions 2002, 2003, 2007
- Microsoft Excel_viewer — versions 2003
- Microsoft Office — versions 2004, 2008
- Microsoft Open_xml_file_format_converter
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@microsoft.com (vdb-entry, x_refsource_SECTRACK)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)