CVE-2009-0238

Home/CVE/Microsoft Office Remote Code Execution

CVE

Microsoft Office Remote Code Execution

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1.

Excel Viewer 2003 Gold and SP3.

Excel Viewer.

Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1.

and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

HIGH · CVSS 8.8 ⚠ CISA KEV EPSS 0.7286

Act now

Listed on CISA KEV (known exploited in the wild)
SSVC exploitation status: active
EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
EPSS percentile: top 1% of all CVEs by exploitation likelihood
CVSS base score ≥ 7.0

Sigma rules13 YARA rules0

⬢

Required Remediation

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

⬡

Weakness Classification

CWE-94Improper Control of Generation of Code ('Code Injection')

▤

Affected Products & Versions

microsoft excelall versions
microsoft excel viewerall versions
microsoft officeall versions
microsoft office compatibility packall versions
microsoft office excel viewerall versions

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

producthighSuspicious Microsoft Office Child Process - MacOS

producthighCode Executed Via Office Add-in XLL File

producthighPotential Persistence Via Microsoft Office Add-In

producthighPotential Persistence Via Microsoft Office Startup Folder

producthighFile With Uncommon Extension Created By An Office Application

producthighOffice Macro File Creation From Suspicious Process

Show all 13 top matchesproducthighUncommon File Created In Office Startup Folder
producthighPotentially Suspicious Office Document Executed From Trusted Location
producthighPython Function Execution Security Warning Disabled In Excel
producthighPotential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
producthighPotential Persistence Via Excel Add-in - Registry
producthighPython Function Execution Security Warning Disabled In Excel - Registry
productmediumMicrosoft Excel Add-In Loaded From Uncommon Location