{"id":"CVE-2009-0557","kind":"vulnerability","aliases":["CVE-2009-0557"],"related":[],"title":"Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007…","description":"Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka \"Object Record Corruption Vulnerability.\"","summary":"Microsoft Office has an object record corruption flaw that a crafted Excel file with a malformed record object can trigger. An attacker who gets a user to open that file can run code on the victim's machine.","severity":"critical","cvss":9.3,"epss":0.52845,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2000","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2003","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2004","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2008","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= xp","ecosystem":"vendor"},{"name":"microsoft office compatibility pack","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft office excel viewer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office excel viewer","fixed":[],"affected":"= 2003","ecosystem":"vendor"},{"name":"microsoft office sharepoint server","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft open xml file format converter","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","exploited","microsoft-office","other","windows"],"not_affected_if":["patched-office"],"how_to_check":null,"fix":"Apply the Microsoft Office updates per vendor instructions, as CISA requires; the sources do not name the specific patch or fixed version.","status":"open","published_at":"2009-06-10T18:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:52+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T21:12:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft Office updates per vendor instructions, as CISA requires; the sources do not name the specific patch or fixed version.","reach":"internet","impact":"high","summary":"Microsoft Office has an object record corruption flaw that a crafted Excel file with a malformed record object can trigger. An attacker who gets a user to open that file can run code on the victim's machine.","category":"other","who_cares":["microsoft-office","excel","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the victim's machine via a crafted Excel file","analyst_note":"Find the Microsoft security bulletin for CVE-2009-0557 to get affected and fixed Office versions and the patch name for the how_to_check and fix fields.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-office"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2824,"output_tokens":339,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0557':25A,28A '-2009':24A,27A '2000':5A,114C '2003':11A,120C,149C '2004':15A,124C '2007':22A,131C,165C '2008':17A,126C 'aka':188C 'allow':171C 'arbitrari':176C 'attack':93B,173C 'code':104B,177C 'compat':158C 'compatibility':45A 'convert':142C 'converter':64A 'corrupt':78B,191C 'craft':82B,180C 'cve':23A,26A 'excel':1A,20A,49A,53A,65B,83B,110C,129C,147C,153C,162C,181C 'execut':175C 'exploit':66B 'file':62A,84B,101B,140C,166C,182C 'flaw':79B 'format':63A,141C,167C 'get':95B 'mac':19A,128C,144C 'machin':109B 'malform':87B,185C 'microsoft':3A,29A,31A,33A,35A,37A,39A,41A,43A,47A,51A,55A,59A,68B,72B,112C,132C,145C,151C,156C 'microsoft-offic':67B 'object':76B,89B,187C,189C 'offic':4A,7A,10A,14A,69B,73B,113C,116C,119C,123C,133C,146C,152C,157C 'office':30A,32A,34A,36A,38A,40A,42A,44A,48A,52A,56A 'open':60A,99B,138C 'pack':46A,159C 'powerpoint':164C 'record':77B,88B,186C,190C 'remot':172C 'run':103B 'server':58A 'sharepoint':57A 'sp1':135C,168C 'sp2':137C,170C 'sp3':6A,9A,12A,115C,118C,121C,150C 'system':134C 'trigger':91B 'user':97B 'via':178C 'victim':107B 'viewer':50A,54A,148C,154C 'vulner':192C 'window':71B 'word':161C 'xml':61A,139C 'xp':8A,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-06-10T18:30:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-0557","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0557","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2009-0557","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0557","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-0557","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0557","severity":null,"published_at":"2009-06-10T18:30:00+00:00","modified_at":"2026-06-16T23:05:18+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}