Microsoft · Office
CVE-2009-0557
Microsoft Office Object Record Corruption Vulnerability
What it is
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
CISA: Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 22, 2022
- Added to the CISA list
- June 8, 2022
- Published
- June 10, 2009
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 53% in the top 1.0% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (7)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021
- http://www.vupen.com/english/advisories/2009/1540
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5564
- http://www.securitytracker.com/id?1022351
- http://osvdb.org/54953
- http://www.securityfocus.com/bid/35241
- http://www.us-cert.gov/cas/techalerts/TA09-160A.html
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 14, 2026 | Remote Code Execution | Office | High 8.8 | 43% |
| Feb 10, 2026 | Word Reliance on Untrusted Inputs in a Security Decision | Office | High 7.8 | 1.6% |
| Jan 26, 2026 | Security Feature Bypass | Office | High 7.8 | 71% |
| Jan 7, 2026 | PowerPoint Code Injection | Office | High 8.8 | 67% |
| Aug 12, 2025 | Excel Remote Code Execution | Office | High 8.8 | 43% |
| Mar 14, 2023 | Outlook Privilege Escalation | Office | Critical 9.8 | 97% |
| Feb 14, 2023 | Publisher Security Feature Bypass | Office | High 7.3 | 12% |
| Jun 8, 2022 | Buffer Overflow | Office | High 7.8 | 60% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.