---
id: "CVE-2009-3129"
kind: "vulnerability"
aliases: ["CVE-2009-3129"]
title: "Microsoft Excel: Microsoft Excel Featheader Record Memory Corruption Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.84034
exploited: true
status: "open"
category: "package"
products: [{"name": "Microsoft Excel", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Microsoft Office Excel", "fixed": ["KB973471", "KB973475", "KB973593 + KB973704", "KB973484", "KB973707", "KB976830", "KB976828", "KB976831"], "affected": "2002 SP3, 2003 SP3, 2007 SP1/SP2, Excel Viewer, Compatibility Pack SP1/SP2, Office 2004/2008 for Mac, Open XML Converter for Mac", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "legacy", "macos", "microsoft-excel", "office", "package", "windows"]
not_affected_if: ["excel-not-installed", "patched-ms09-067", "patched-office"]
published_at: "2009-11-11T19:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3129", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-3129", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:26:46+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3129", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Excel: Microsoft Excel Featheader Record Memory Corruption Vulnerability

Excel FEATHEADER record memory corruption (CVE-2009-3129): opening a crafted .xls runs code as the user. Fixed by Microsoft MS09-067 in Nov 2009. Only matters for legacy, unpatched Office; listed in CISA KEV as exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Excel affected ? fixed ?
- vendor:Microsoft Office Excel affected 2002 SP3, 2003 SP3, 2007 SP1/SP2, Excel Viewer, Compatibility Pack SP1/SP2, Office 2004/2008 for Mac, Open XML Converter for Mac fixed KB973471, KB973475, KB973593 + KB973704, KB973484, KB973707, KB976830, KB976828, KB976831

## How to check

Check whether the MS09-067 update for your Excel is installed: KB973471 (Excel 2002 SP3), KB973475 (Excel 2003 SP3), KB973593 plus KB973704 (Excel 2007 SP1/SP2), KB973484 / KB973707 (Excel Viewer), KB973704 (Compatibility Pack), KB976830 / KB976828 / KB976831 (Mac). Any of these missing means exposed.

## Fix

Install MS09-067 (KB972652) per product. Excel 2007 needs both KB973593 and the Compatibility Pack update KB973704. Unsupported Office versions should be upgraded.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-3129
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2009-3129
- 2026-10-23T21:26:46+00:00 analyst — Read MS09-067 (KB972652, Nov 10 2009): CVE-2009-3129 fixed there. Exploitation from CISA KEV; PoC link not checked. Bulletin gives patches not build numbers.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2009-3129

## Documents

- [advisory] Microsoft Security Bulletin MS09-067 (972652) https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067

## From the sources

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_