{"id":"CVE-2009-0556","kind":"vulnerability","aliases":["CVE-2009-0556"],"related":[],"title":"Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac,…","description":"Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Microsoft Office PowerPoint has a code injection flaw triggered by a crafted .ppt file containing an OutlineTextRefAtom with an invalid index, which corrupts memory. An attacker who gets a user to open the file can run arbitrary code on that machine.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-01-07T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office powerpoint","fixed":[],"affected":"= 2004","ecosystem":"vendor"},{"name":"microsoft powerpoint","fixed":[],"affected":"= 2000","ecosystem":"vendor"},{"name":"microsoft powerpoint","fixed":[],"affected":"= 2002","ecosystem":"vendor"},{"name":"microsoft powerpoint","fixed":[],"affected":"= 2003","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-office","package","powerpoint","windows"],"not_affected_if":["no-powerpoint-installed"],"how_to_check":null,"fix":"Apply the vendor mitigations per Microsoft guidance, or stop using the affected PowerPoint version if no mitigation is available (per CISA KEV required action). Specific patch names and fixed versions are not in the sources.","status":"open","published_at":"2009-04-03T18:30:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:39+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:42:39Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per Microsoft guidance, or stop using the affected PowerPoint version if no mitigation is available (per CISA KEV required action). Specific patch names and fixed versions are not in the sources.","reach":"internet","summary":"Microsoft Office PowerPoint has a code injection flaw triggered by a crafted .ppt file containing an OutlineTextRefAtom with an invalid index, which corrupts memory. An attacker who gets a user to open the file can run arbitrary code on that machine.","category":"package","who_cares":["microsoft-office","powerpoint","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the victim's machine after they open a malicious presentation.","analyst_note":"Find the Microsoft security bulletin and the exact affected PowerPoint versions and patch IDs for CVE-2009-0556 (search MS09-017); the sources give no versions or check method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-powerpoint-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000462,"input_tokens":2558,"output_tokens":413,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':128C '-0556':21A,24A '-2009':20A,23A '2000':4A '2002':6A '2003':9A '2004':16A '22':127C 'action':118C 'allow':93C 'appli':119C 'applic':125C 'arbitrari':79B,98C 'attack':68B,95C 'bod':126C 'cisa':116C 'cloud':131C 'code':48B,80B,89C,99C 'contain':57B,87C,107C 'corrupt':65B,115C 'craft':54B 'cve':19A,22A 'discontinu':134C 'execut':97C 'exploit':36B 'file':56B,76B,103C 'flaw':50B 'follow':124C 'get':70B 'guidanc':129C 'index':63B,110C 'inject':49B,90C 'instruct':123C 'invalid':62B,109C 'mac':18A 'machin':83B 'memori':66B,114C 'microsoft':1A,14A,25A,27A,30A,32A,34A,38B,43B,84C 'microsoft-offic':37B 'mitig':120C,140C 'offic':2A,15A,39B,44B,85C 'office':26A,28A 'open':74B 'outlinetextrefatom':59B,106C 'packag':40B 'per':121C 'powerpoint':3A,12A,29A,31A,33A,35A,41B,45B,86C,102C 'ppt':55B 'product':138C 'remot':94C 'requir':117C 'run':78B 'servic':132C 'sp3':5A,7A,10A 'trigger':51B,113C 'unavail':142C 'use':135C 'user':72B 'valu':111C 'vendor':122C 'via':100C 'vulner':91C 'window':42B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-04-03T18:30:00+00:00","kev":{"dateAdded":"2026-01-07","dueDate":"2026-01-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-0556","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556","severity":null,"published_at":"2026-01-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-0556","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0556","severity":null,"published_at":"2009-04-03T18:30:00+00:00","modified_at":"2026-06-16T23:05:17+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}