{"id":"CVE-2009-3129","kind":"vulnerability","aliases":["CVE-2009-3129"],"related":[],"title":"Microsoft Excel: Microsoft Excel Featheader Record Memory Corruption Vulnerability","description":"Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka \"Excel Featheader Record Memory Corruption Vulnerability.\"","summary":"Excel FEATHEADER record memory corruption (CVE-2009-3129): opening a crafted .xls runs code as the user. Fixed by Microsoft MS09-067 in Nov 2009. Only matters for legacy, unpatched Office; listed in CISA KEV as exploited.","severity":"critical","cvss":9.3,"epss":0.84034,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Microsoft Excel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft Office Excel","fixed":["KB973471","KB973475","KB973593 + KB973704","KB973484","KB973707","KB976830","KB976828","KB976831"],"affected":"2002 SP3, 2003 SP3, 2007 SP1/SP2, Excel Viewer, Compatibility Pack SP1/SP2, Office 2004/2008 for Mac, Open XML Converter for Mac","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","legacy","macos","microsoft-excel","office","package","windows"],"not_affected_if":["excel-not-installed","patched-ms09-067","patched-office"],"how_to_check":"Check whether the MS09-067 update for your Excel is installed: KB973471 (Excel 2002 SP3), KB973475 (Excel 2003 SP3), KB973593 plus KB973704 (Excel 2007 SP1/SP2), KB973484 / KB973707 (Excel Viewer), KB973704 (Compatibility Pack), KB976830 / KB976828 / KB976831 (Mac). Any of these missing means exposed.","fix":"Install MS09-067 (KB972652) per product. Excel 2007 needs both KB973593 and the Compatibility Pack update KB973704. Unsupported Office versions should be upgraded.","status":"open","published_at":"2009-11-11T19:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:13+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T21:26:13Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Excel per vendor instructions (CISA required action); exact patched builds not stated in sources.","reach":"internet","impact":"high","summary":"Microsoft Excel has a memory corruption flaw triggered by a spreadsheet containing a malformed FEATHEADER record with an invalid size value. An attacker who gets a user to open such a file can run arbitrary code on the machine.","category":"package","who_cares":["microsoft-excel","windows","office"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary code runs on the victim's machine when a crafted spreadsheet is opened.","analyst_note":"Find the Microsoft security bulletin for CVE-2009-3129 to list affected Excel versions and patch names; the sources do not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["excel-not-installed","patched-office"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000466,"input_tokens":2851,"output_tokens":361,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Microsoft security bulletin for CVE-2009-3129 to list affected Excel versions and patch names; the sources do not give them.","search":"'-067':51B '-2009':11A,14A,36B '-3129':12A,15A,37B '2002':70C '2003':72C,95C '2004':80C '2007':75C,112C '2008':82C '2009':54B 'affect':139C 'aka':143C 'allow':118C 'arbitrari':123C 'attack':120C 'cbhdrdata':135C 'cisa':63B 'code':43B,124C 'compat':105C 'contain':132C 'convert':89C 'corrupt':8A,34B,148C 'craft':40B 'cve':10A,13A,35B 'element':137C 'excel':2A,4A,17A,20A,26B,30B,69C,93C,98C,109C,144C 'execut':122C 'exploit':21B,66B 'feathead':5A,31B,130C,145C 'file':87C,113C 'fix':47B 'format':88C,114C 'invalid':134C 'kev':64B 'legaci':22B,58B 'list':61B 'mac':84C,91C 'maco':23B 'matter':56B 'memori':7A,33B,147C 'microsoft':1A,3A,16A,18A,25B,49B,67C 'microsoft-excel':24B 'ms09':50B 'nov':53B 'offic':27B,60B,68C,79C,92C,97C,104C 'office':19A 'offset':142C 'open':38B,85C 'pack':106C 'packag':28B 'pointer':141C 'powerpoint':111C 'record':6A,32B,131C,146C 'remot':119C 'run':42B 'size':136C 'sp1':76C,100C,115C 'sp2':78C,102C,117C 'sp3':71C,73C,96C 'spreadsheet':127C 'unpatch':59B 'user':46B 'via':125C 'viewer':94C,99C 'vulner':9A,149C 'window':29B 'word':108C 'xls':41B 'xml':86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-11-11T19:30:00+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-3129","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3129","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2009-3129","url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3129","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2009-3129:78","url":null,"severity":null,"published_at":"2026-10-23T21:26:46+00:00","modified_at":"2026-10-23T21:26:46+00:00","first_seen_at":"2026-10-23T21:26:46+00:00","fetched_at":"2026-10-23T21:26:46+00:00","note":"Read MS09-067 (KB972652, Nov 10 2009): CVE-2009-3129 fixed there. Exploitation from CISA KEV; PoC link not checked. Bulletin gives patches not build numbers."},{"source":"nvd","external_id":"CVE-2009-3129","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3129","severity":null,"published_at":"2009-11-11T19:30:00+00:00","modified_at":"2026-06-16T23:11:00+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1017,"url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067","title":"Microsoft Security Bulletin MS09-067 (972652)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}