CVE-2009-0238

Deferred
Published: 25 Feb 2009, 16:00
Last modified:15 Apr 2026, 03:58

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.3 HIGH
v2.0 (nvd)
EPSS Score
81.14% CRITICAL
81% probability +23.97%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Feb 2009, 16:00
Published
Vulnerability first disclosed
14 Apr 2026, 00:00
Added to CISA KEV
Microsoft Office Remote Code Execution
15 Apr 2026, 03:58
Last Modified
Vulnerability information updated
28 Apr 2026, 00:00
CISA Remediation Due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 9.3AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 81.14%• Percentile: 99%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • Unknown•Excel

    2004

  • Unknown•Office

    2008

  • microsoft•office_compatibility_pack

    2007:sp1

  • microsoft•office_excel

    2000:sp3 | 2002:sp3 | 2003:sp3 | 2007:sp1

  • microsoft•office_excel_viewer

    2003:gold | 2003:sp3

References (12)