CVE-2009-3128
Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 24.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 24.88% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/compatibility pack word excel powerpoint · microsoft/excel · microsoft/excel viewer · microsoft/office · microsoft/open xml file format converter
- Source
- secure@microsoft.com
References
- http://www.securitytracker.com/id?1023157
- http://www.us-cert.gov/cas/techalerts/TA09-314A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6474
- http://www.securitytracker.com/id?1023157
- http://www.us-cert.gov/cas/techalerts/TA09-314A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6474
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.