---
id: "CVE-2009-0556"
kind: "vulnerability"
aliases: ["CVE-2009-0556"]
title: "Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac,\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Microsoft Office", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft office powerpoint", "fixed": [], "affected": "= 2004", "ecosystem": "vendor"}, {"name": "microsoft powerpoint", "fixed": [], "affected": "= 2000", "ecosystem": "vendor"}, {"name": "microsoft powerpoint", "fixed": [], "affected": "= 2002", "ecosystem": "vendor"}, {"name": "microsoft powerpoint", "fixed": [], "affected": "= 2003", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "microsoft-office", "package", "powerpoint", "windows"]
not_affected_if: ["no-powerpoint-installed"]
published_at: "2009-04-03T18:30:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0556", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac,…

Microsoft Office PowerPoint has a code injection flaw triggered by a crafted .ppt file containing an OutlineTextRefAtom with an invalid index, which corrupts memory. An attacker who gets a user to open the file can run arbitrary code on that machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office affected ? fixed ?
- vendor:microsoft office powerpoint affected = 2004 fixed ?
- vendor:microsoft powerpoint affected = 2000 fixed ?
- vendor:microsoft powerpoint affected = 2002 fixed ?
- vendor:microsoft powerpoint affected = 2003 fixed ?

## Fix

Apply the vendor mitigations per Microsoft guidance, or stop using the affected PowerPoint version if no mitigation is available (per CISA KEV required action). Specific patch names and fixed versions are not in the sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0556
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-0556

## From the sources

Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_