{"id":"CVE-2009-0563","kind":"vulnerability","aliases":["CVE-2009-0563"],"related":[],"title":"Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for…","description":"Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka \"Word Buffer Overflow Vulnerability.\"","summary":"Microsoft Office has a buffer overflow triggered by a crafted Word document with an invalid length field in a tag. An attacker who gets a user to open the file can run code on that user's machine.","severity":"critical","cvss":9.3,"epss":0.59634,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2000","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2003","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2004","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2008","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= xp","ecosystem":"vendor"},{"name":"microsoft office compatibility pack","fixed":[],"affected":"= 2007","ecosystem":"vendor"},{"name":"microsoft office word viewer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office word viewer","fixed":[],"affected":"= 2003","ecosystem":"vendor"},{"name":"microsoft open xml file format converter","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-office","package","windows","word"],"not_affected_if":["no-word-documents-opened","office-patched"],"how_to_check":null,"fix":"Apply the Microsoft updates for the affected Office version per vendor instructions (CISA KEV required action). Specific patch names are unknown from the sources.","status":"open","published_at":"2009-06-10T18:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:51+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:12:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for the affected Office version per vendor instructions (CISA KEV required action). Specific patch names are unknown from the sources.","reach":"internet","impact":"high","summary":"Microsoft Office has a buffer overflow triggered by a crafted Word document with an invalid length field in a tag. An attacker who gets a user to open the file can run code on that user's machine.","category":"package","who_cares":["microsoft-office","word","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote code runs as the user who opens a crafted Word document.","analyst_note":"Find the affected Office versions and the Microsoft security bulletin for CVE-2009-0563 to fill in how_to_check and fix; sources give no version list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["office-patched","no-word-documents-opened"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000456,"input_tokens":2829,"output_tokens":347,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0563':23A,26A '-2009':22A,25A '2002':10A,113C '2003':12A,115C,140C '2004':126C '2007':15A,118C,156C '2008':128C 'aka':182C 'allow':162C 'arbitrari':167C 'attack':87B,164C 'base':3A,106C 'buffer':4A,70B,107C,184C 'code':98B,168C 'compat':149C 'compatibility':43A 'contain':177C 'convert':133C 'converter':58A 'craft':75B,175C 'cve':21A,24A 'document':77B,172C 'excel':153C 'execut':166C 'exploit':59B 'field':82B,181C 'file':56A,95B,131C,157C 'format':57A,132C,158C 'get':89B 'invalid':80B,179C 'length':81B,180C 'mac':125C,135C 'machin':103B 'microsoft':7A,19A,27A,29A,31A,33A,35A,37A,39A,41A,45A,49A,53A,61B,66B,110C,122C,136C,142C,147C 'microsoft-offic':60B 'offic':8A,20A,62B,67B,111C,123C,137C,143C,148C 'office':28A,30A,32A,34A,36A,38A,40A,42A,46A,50A 'open':54A,93B,129C 'overflow':5A,71B,108C,185C 'pack':44A,150C 'packag':63B 'powerpoint':155C 'remot':163C 'run':97B 'sp1':16A,119C,159C 'sp2':18A,121C,161C 'sp3':11A,13A,114C,116C,141C 'stack':2A,105C 'stack-bas':1A,104C 'tag':85B,176C 'trigger':72B 'user':91B,101B 'via':169C 'viewer':48A,52A,139C,145C 'vulner':186C 'window':64B 'word':9A,47A,51A,65B,76B,112C,138C,144C,152C,171C,183C 'xml':55A,130C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-06-10T18:00:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-0563","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-0563","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2009-0563","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-0563","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-0563","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0563","severity":null,"published_at":"2009-06-10T18:00:00+00:00","modified_at":"2026-06-16T23:05:18+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}