CVE-2009-0557KEV · OVERDUE

Microsoft Office Object Record Corruption Vulnerability

High · published June 10, 2009

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

1584
days past CISA
deadline
CVSS v3.1
7.8
EPSS
53%
Percentile
99.0
In the wild
Confirmed
What it is

🚨 A crafted Excel file could let attackers run any code they want, and that’s not just a bad spreadsheet! 🔥 Think of it like a restaurant delivering a pizza with an extra topping that nobody ordered—if you don't check it before taking a bite, it could be something nasty! An attacker could exploit this vulnerability to execute arbitrary code on your system, potentially leading to data breaches, system compromise, or even total takeover. It’s like letting a stranger waltz into your office and start messing with your computer—absolutely devastating!

Put simply

Think of it like a restaurant delivering a pizza with an extra topping that nobody ordered—if you don't check it before taking a bite, it could be something nasty! This vulnerability arises from a corrupted object record in Excel, allowing attackers to craft a malicious Excel file that, when opened, can lead to arbitrary code execution. This affects several versions of Microsoft Office and Excel, including older ones like Office 2000 and Office XP.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on your system, potentially leading to data breaches, system compromise, or even total takeover. It’s like letting a stranger waltz into your office and start messing with your computer—absolutely devastating! To mitigate this vulnerability, immediately update to the latest patches provided by Microsoft. Users of affected systems should also avoid opening untrusted Excel files and consider using file viewers or converters that aren't affected by this flaw. Stay vigilant! You've got this! Follow these steps, and you'll be protecting your system from this Excel mischief in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.52845 · 99.0th percentile
Published
2009-06-10T18:00Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 10 JUN 18:00Z
    Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open…
    cvelistv5