CVE-2009-0238
Microsoft Office Remote Code Execution
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 28 April 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 42.94% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 14 April 2026 · due 28 April 2026
- Weakness
- CWE-94
- Affected
- microsoft/excel · microsoft/excel viewer · microsoft/office · microsoft/office compatibility pack · microsoft/office excel viewer
- Source
- secure@microsoft.com
EPSS 42.9% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ; https://nvd.nist.gov/vuln/detail/CVE-2009-0238
References
- http://blogs.zdnet.com/security/?p=2658Broken Link
- http://isc.sans.org/diary.html?storyid=5923Press/Media Coverage
- http://securitytracker.com/id?1021744Broken Link
- http://www.microsoft.com/technet/security/advisory/968272.mspxVendor Advisory
- http://www.securityfocus.com/bid/33870Broken Link
- http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-104A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/1023Broken Link
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48875Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968Broken Link
- http://blogs.zdnet.com/security/?p=2658Broken Link
- http://isc.sans.org/diary.html?storyid=5923Press/Media Coverage
- http://securitytracker.com/id?1021744Broken Link
- http://www.microsoft.com/technet/security/advisory/968272.mspxVendor Advisory
- http://www.securityfocus.com/bid/33870Broken Link
- http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-104A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/1023Broken Link
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48875Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.