Live › vulnerability › CVE-2009-0557
Go to dashboardMicrosoft Office has an object record corruption flaw that a crafted Excel file with a malformed record object can trigger. An attacker who gets a user to open that file can run code on the victim's machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Office | vendor | – | – |
| microsoft office | vendor | = 2000 | – |
| microsoft office | vendor | = 2003 | – |
| microsoft office | vendor | = 2004 | – |
| microsoft office | vendor | = 2007 | – |
| microsoft office | vendor | = 2008 | – |
| microsoft office | vendor | = xp | – |
| microsoft office compatibility pack | vendor | = 2007 | – |
| microsoft office excel viewer | vendor | – | – |
| microsoft office excel viewer | vendor | = 2003 | – |
| microsoft office sharepoint server | vendor | = 2007 | – |
| microsoft open xml file format converter | vendor | – | – |
Unknown from the sources.
Apply the Microsoft Office updates per vendor instructions, as CISA requires; the sources do not name the specific patch or fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
This page as .md · .json · in your agent: get_signal("CVE-2009-0557")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.