Microsoft · Office
CVE-2009-0556
Microsoft Office PowerPoint Code Injection Vulnerability
What it is
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
CISA: Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: January 28, 2026
- Added to the CISA list
- January 7, 2026
- Published
- April 3, 2009
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 67% in the top 0.7% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (18)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017
- http://www.zerodayinitiative.com/advisories/ZDI-09-019
- http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx
- http://www.vupen.com/english/advisories/2009/1290
- http://osvdb.org/53182
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49632
- http://www.securityfocus.com/bid/34351
- http://www.vupen.com/english/advisories/2009/0915
- http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx
- http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279
- http://secunia.com/advisories/34572
- http://www.securitytracker.com/id?1021967
- http://www.us-cert.gov/cas/techalerts/TA09-132A.html
- http://www.microsoft.com/technet/security/advisory/969136.mspx
- http://www.kb.cert.org/vuls/id/627331
- http://www.securityfocus.com/archive/1/503453/100/0/threaded
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 14, 2026 | Remote Code Execution | Office | High 8.8 | 43% |
| Feb 10, 2026 | Word Reliance on Untrusted Inputs in a Security Decision | Office | High 7.8 | 1.6% |
| Jan 26, 2026 | Security Feature Bypass | Office | High 7.8 | 71% |
| Aug 12, 2025 | Excel Remote Code Execution | Office | High 8.8 | 43% |
| Mar 14, 2023 | Outlook Privilege Escalation | Office | Critical 9.8 | 97% |
| Feb 14, 2023 | Publisher Security Feature Bypass | Office | High 7.3 | 12% |
| Jun 8, 2022 | Object Record Corruption | Office | High 7.8 | 53% |
| Jun 8, 2022 | Buffer Overflow | Office | High 7.8 | 60% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.