CVE-2009-0238

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-0238
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://blogs.zdnet.com/security/?p=2658 Broken Link
http://isc.sans.org/diary.html?storyid=5923 Press/Media Coverage
http://securitytracker.com/id?1021744 Broken Link
http://www.microsoft.com/technet/security/advisory/968272.mspx Vendor Advisory
http://www.securityfocus.com/bid/33870 Broken Link
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 Broken Link
http://www.us-cert.gov/cas/techalerts/TA09-104A.html US Government Resource
http://www.vupen.com/english/advisories/2009/1023 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 Broken Link
http://blogs.zdnet.com/security/?p=2658 Broken Link
http://isc.sans.org/diary.html?storyid=5923 Press/Media Coverage
http://securitytracker.com/id?1021744 Broken Link
http://www.microsoft.com/technet/security/advisory/968272.mspx Vendor Advisory
http://www.securityfocus.com/bid/33870 Broken Link
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 Broken Link
http://www.us-cert.gov/cas/techalerts/TA09-104A.html US Government Resource
http://www.vupen.com/english/advisories/2009/1023 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:microsoft:excel:2000:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*
History

22 Apr 2026, 16:42

Type Values Removed Values Added
References () http://blogs.zdnet.com/security/?p=2658 - () http://blogs.zdnet.com/security/?p=2658 - Broken Link
References () http://isc.sans.org/diary.html?storyid=5923 - () http://isc.sans.org/diary.html?storyid=5923 - Press/Media Coverage
References () http://securitytracker.com/id?1021744 - () http://securitytracker.com/id?1021744 - Broken Link
References () http://www.securityfocus.com/bid/33870 - () http://www.securityfocus.com/bid/33870 - Broken Link
References () http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 - () http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 - Broken Link
References () http://www.vupen.com/english/advisories/2009/1023 - () http://www.vupen.com/english/advisories/2009/1023 - Broken Link
References () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 - () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 - Vendor Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 - Third Party Advisory
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 - Broken Link
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238 - US Government Resource
CPE cpe:2.3:a:microsoft:excel:2004:*:mac:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel:2002:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel_viewer:2003:gold:*:*:*:*:*:*		 cpe:2.3:a:microsoft:excel:2000:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*

14 Apr 2026, 18:16

Type Values Removed Values Added
CVSS v2 : 9.3
v3 : unknown 		v2 : 9.3
v3 : 8.8
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238 -

21 Nov 2024, 00:59

Type Values Removed Values Added
References () http://blogs.zdnet.com/security/?p=2658 - () http://blogs.zdnet.com/security/?p=2658 -
References () http://isc.sans.org/diary.html?storyid=5923 - () http://isc.sans.org/diary.html?storyid=5923 -
References () http://securitytracker.com/id?1021744 - () http://securitytracker.com/id?1021744 -
References () http://www.microsoft.com/technet/security/advisory/968272.mspx - Vendor Advisory () http://www.microsoft.com/technet/security/advisory/968272.mspx - Vendor Advisory
References () http://www.securityfocus.com/bid/33870 - () http://www.securityfocus.com/bid/33870 -
References () http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 - () http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 -
References () http://www.us-cert.gov/cas/techalerts/TA09-104A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA09-104A.html - US Government Resource
References () http://www.vupen.com/english/advisories/2009/1023 - () http://www.vupen.com/english/advisories/2009/1023 -
References () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 - () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 -
Information

Published : 2009-02-25 16:30

Updated : 2026-04-22 16:42

NVD link : CVE-2009-0238

Mitre link : CVE-2009-0238

CVE.ORG link : CVE-2009-0238

JSON object : View

Products Affected

microsoft

  • office
  • excel
  • office_excel_viewer
  • excel_viewer
  • office_compatibility_pack
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')