CVE-2009-0556: Microsoft Office PowerPoint Code Injection Vulnerability
Vulnerability summary
CVE-2009-0556 is a high (CVSS 9.3) Code Injection vulnerability in Microsoft Office. It is known to be exploited: CISA lists it, first on 07-01-2026. EPSS estimates a 67.31% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.
Timeline
- 03-04-2009PublishedVulnerability first disclosed.
- 07-01-2026Added to CISA KEVMicrosoft Office PowerPoint Code Injection Vulnerability
- 08-01-2026Last modifiedVulnerability information updated.
- 28-01-2026CISA remediation dueApply mitigations per vendor instructions.
Description
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
67.31%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 67.31% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 07-01-2026
- Federal due date
- 28-01-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 nvd.nist.gov/vuln/detail/CVE-2009-0556
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft2 products
- office_powerpoint2004
- powerpoint2000:sp3 | 2002:sp3 | 2003:sp3
1 vendor · 2 products
References
19 links- blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspxX Refsource CONFIRMVendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017Vendor AdvisoryX Refsource MS- blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspxX Refsource CONFIRMVendor Advisory
- blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspxX Refsource CONFIRMVendor Advisory
Show all 19 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279VDB EntrySignatureX Refsource OVALBroken Link
- www.us-cert.gov/cas/techalerts/TA09-132A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204VDB EntrySignatureX Refsource OVALBroken Link
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556Government ResourceUS Government Resource