{"id":"CVE-2009-0238","kind":"vulnerability","aliases":["CVE-2009-0238"],"related":[],"title":"Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer;…","description":"Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.","summary":"Microsoft Excel has a remote code execution bug triggered by opening a specially crafted file containing a malformed object. An attacker who gets a user to open the file can take full control of the machine, and CISA lists it as actively exploited.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-04-14T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft excel","fixed":[],"affected":"= 2000","ecosystem":"vendor"},{"name":"microsoft excel","fixed":[],"affected":"= 2002","ecosystem":"vendor"},{"name":"microsoft excel","fixed":[],"affected":"= 2003","ecosystem":"vendor"},{"name":"microsoft excel","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft excel viewer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2004","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2008","ecosystem":"vendor"},{"name":"microsoft office compatibility pack","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft office excel viewer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office excel viewer","fixed":[],"affected":"= 2003","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","exploited","microsoft-office","package","windows"],"not_affected_if":["no-office-installed"],"how_to_check":null,"fix":"Apply the vendor mitigations and patches referenced by CISA for Microsoft Office; the sources do not name the specific patch or version.\nIf no mitigation is available, discontinue use of the affected product per CISA guidance.","status":"open","published_at":"2009-02-25T16:30:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:50+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:38:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations and patches referenced by CISA for Microsoft Office; the sources do not name the specific patch or version.\nIf no mitigation is available, discontinue use of the affected product per CISA guidance.","reach":"local","summary":"Microsoft Excel has a remote code execution bug triggered by opening a specially crafted file containing a malformed object. An attacker who gets a user to open the file can take full control of the machine, and CISA lists it as actively exploited.","category":"package","who_cares":["microsoft-office","excel","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gets full control of the user's machine after the user opens a crafted Excel file.","analyst_note":"Find the Microsoft security bulletin for CVE-2009-0238 (MS09-027) to confirm affected Office versions and the patch to install.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-office-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00044,"input_tokens":2533,"output_tokens":374,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0238':23A,26A '-2009':22A,25A '2000':4A,109C '2002':6A,111C '2003':8A,15A,113C,120C '2004':142C '2007':11A,116C,133C '2008':144C '2009':175C 'access':162C 'activ':104B 'allow':147C 'arbitrari':152C 'attack':83B,149C 'attempt':163C 'bug':70B 'cisa':100B 'code':68B,153C 'compat':126C 'compatibility':46A 'contain':78B 'control':95B 'craft':76B,156C 'cve':21A,24A 'document':158C 'excel':3A,13A,19A,30A,32A,34A,36A,38A,50A,54A,56B,64B,108C,118C,124C,130C,138C,157C 'execut':69B,151C 'exploit':57B,105B,169C 'februari':174C 'file':77B,91B,134C 'format':135C 'full':94B 'get':85B 'gold':16A,121C 'invalid':166C 'list':101B 'mac':146C 'machin':98B 'malform':80B 'microsoft':1A,27A,29A,31A,33A,35A,37A,40A,42A,44A,48A,52A,59B,63B,106C,140C 'microsoft-offic':58B 'object':81B,167C 'offic':2A,60B,107C,141C 'office':28A,41A,43A,45A,49A,53A 'open':73B,89B 'pack':47A,127C 'packag':61B 'powerpoint':132C 'remot':67B,148C 'sp1':12A,117C,136C 'sp3':5A,7A,9A,18A,110C,112C,114C,123C 'special':75B 'take':93B 'trigger':71B,160C 'trojan.mdropper.ac':177C 'user':87B 'via':154C 'viewer':14A,20A,39A,51A,55A,119C,125C 'wild':172C 'window':62B 'word':129C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-02-25T16:30:00+00:00","kev":{"dateAdded":"2026-04-14","dueDate":"2026-04-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-0238","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0238","severity":null,"published_at":"2026-04-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-0238","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0238","severity":null,"published_at":"2009-02-25T16:30:00+00:00","modified_at":"2026-06-16T23:04:33+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}