CVE-2009-0238
Microsoft Office Remote Code Execution
Description
CVE-2009-0238 is a HIGH-severity remote code execution vulnerability in Microsoft Office Excel with a CVSS 3.1 score of 8.8. The flaw allows remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, and according to the NVD description it was already exploited in the wild in February 2009 by Trojan.Mdropper.AC. CISA added CVE-2009-0238 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-04-14 with a remediation deadline of 2026-04-28, and the EPSS score of 81.1% (99.164th percentile) indicates near-certain exploitation activity. Affected products include Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1, Excel Viewer 2003 Gold and SP3, the standalone Excel Viewer, the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, and Excel in Microsoft Office 2004 and 2008 for Mac — any organization still running these legacy Office builds should treat this code injection vulnerability as an urgent patching priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | excel | 2000; 2002; 2003; 2007 |
| microsoft | excel viewer | All versions |
| microsoft | office | 2004; 2008 |
| microsoft | office compatibility pack | 2007 |
| microsoft | office excel viewer | 2003 |
References
- http://blogs.zdnet.com/security/?p=2658(Broken Link)
- http://isc.sans.org/diary.html?storyid=5923(Press/Media Coverage)
- http://securitytracker.com/id?1021744(Broken Link)
- http://www.microsoft.com/technet/security/advisory/968272.mspx(Vendor Advisory)
- http://www.securityfocus.com/bid/33870(Broken Link)
- http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99(Broken Link)
- http://www.us-cert.gov/cas/techalerts/TA09-104A.html(US Government Resource)
- http://www.vupen.com/english/advisories/2009/1023(Broken Link)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009(Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48875(Third Party Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2009-0238 is classified as a code injection flaw in which a malformed Excel document leads Microsoft Office Excel to access an invalid object, enabling externally-influenced input to drive the execution of attacker-controlled code. In this family of weaknesses, software constructs or interprets a code path using untrusted input without neutralizing the special elements that alter program behavior, so a specially crafted .xls file can redirect Excel's execution flow and run arbitrary native code in the user's security context.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2009-0238 carries a CVSS 3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which translates to remotely exploitable without physical access via a crafted Excel file delivered by email, web download, or a shared document repository. The Attack Complexity is Low with no authentication required, but User Interaction is Required: a victim must open the malicious spreadsheet, which is a trivial condition to meet in practice given how routinely Excel documents are exchanged in enterprise environments. Confidentiality, Integrity, and Availability impacts are all HIGH, so successful exploitation grants the attacker full arbitrary code execution in the user's context — reading sensitive files, modifying or deleting data, installing persistence, and disrupting systems. Although the Scope is Unchanged, Excel is typically launched under an interactive user session with access to network shares and credential material, making post-exploitation pivoting straightforward. The EPSS score of 81.1% (99.164th percentile) reinforces that CVE-2009-0238 remains one of the most actively exploited vulnerabilities tracked.
Exploit Maturity
Active exploitation of CVE-2009-0238 is well established: the NVD record explicitly documents in-the-wild use by Trojan.Mdropper.AC in February 2009, and CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-04-14 with a federal remediation deadline of 2026-04-28. Exploitation probability is extremely high — the EPSS score of 81.1% sits in the 99.164th percentile, one of the highest possible ratings, indicating near-certain ongoing exploitation attempts. Public exploitation guidance and indicators have been published by multiple third-party sources including the SANS Internet Storm Center diary, the Symantec Trojan.Mdropper.AC writeup, the SecurityTracker advisory, the SecurityFocus BID 33870 entry, the VUPEN advisory, and US-CERT TA09-104A, meaning exploit recipes are broadly accessible. Ransomware association is not marked in the KEV catalog, but malicious Excel droppers are a common precursor to ransomware staging, so any Excel-based code execution bug against legacy Office deserves urgent treatment.
Remediation
- Apply Microsoft Security Bulletin MS09-009 immediately. CISA's KEV directive requires remediation by 2026-04-28. Install the patches documented at docs.microsoft.com on every system running an affected Office or Excel Viewer build.
- Identify every affected Office installation. Inventory Microsoft Office Excel 2000 SP3, Excel 2002 SP3, Excel 2003 SP3, Excel 2007 SP1, Excel Viewer 2003 Gold/SP3, the standalone Excel Viewer, the Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, and Excel in Office 2004/2008 for Mac. Unsupported legacy versions that cannot be patched must be uninstalled or isolated.
- Upgrade or decommission end-of-life Office versions. Office 2000, 2002, 2003, and the Mac 2004/2008 builds are long past their support lifecycle. Replace them with supported Microsoft 365 or supported on-premises Office releases rather than relying on a single security bulletin as a permanent fix.
- Implement defensive file-handling controls. Block or sandbox inbound .xls, .xlt, .xlw, and other Excel formats at the email gateway and web proxy; enforce Microsoft Office Protected View and Office File Block settings for legacy formats; and disable Office macros where not explicitly required.
- Hunt for indicators of Trojan.Mdropper.AC and related activity. Review endpoint logs and EDR telemetry for Excel spawning unusual child processes, dropper binaries in user temp directories, and outbound connections from Excel processes. The Symantec writeup and US-CERT TA09-104A document historical indicators that remain relevant to compromise assessment.
- Address the broader code injection risk in the Office ecosystem. Consistent with CWE-94 guidance, do not open untrusted Office documents on systems that hold sensitive data, segment workstations that must process external documents from high-value systems, and keep all Office components — including Compatibility Packs and Viewers — patched in lockstep with the core suite.
Technical Details
CVE-2009-0238 is a remote code execution vulnerability in Microsoft Office Excel triggered by a crafted spreadsheet that causes Excel to perform an access attempt on an invalid object, corrupting internal state in a way that the attacker can leverage to hijack the program's execution flow. Weakness class: the underlying weakness is CWE-94 Improper Control of Generation of Code ('Code Injection') — attacker-supplied file content drives the construction or interpretation of code paths that Excel subsequently executes, resulting in arbitrary code running in the user's security context without any separate privilege escalation step. Attack vector: exploitation is network-based (AV:N) through any channel that delivers an Excel file — spear-phishing, drive-by download, or shared file repositories — and succeeds once the victim opens the document, which satisfies the User Interaction (Required) metric. CVSS vector analysis: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects low complexity, no required privileges, user interaction to open the file, unchanged scope, and full HIGH impact on confidentiality, integrity, and availability of the target system. The NVD description explicitly notes in-the-wild exploitation in February 2009 by Trojan.Mdropper.AC, establishing that working attacks predate the public advisory.
Frequently Asked Questions
Is CVE-2009-0238 being actively exploited?
Yes. CISA added CVE-2009-0238 to the Known Exploited Vulnerabilities catalog on 2026-04-14, and the NVD description confirms in-the-wild exploitation as early as February 2009 by Trojan.Mdropper.AC. The EPSS score of 81.1% (99.164th percentile) places it among the most likely vulnerabilities in the entire CVE corpus to see continued exploitation.
What products are affected by CVE-2009-0238?
CVE-2009-0238 affects Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; the standalone Excel Viewer; the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac. Any environment still running these legacy Office versions should treat this vulnerability as a priority.
How do I fix CVE-2009-0238?
Install the patches published in Microsoft Security Bulletin MS09-009 on every affected Office and Excel Viewer installation, and replace end-of-life Office versions with supported releases. Block or sandbox Excel attachments at the email and web gateway, enforce Protected View for legacy formats, and scan endpoints for indicators of Trojan.Mdropper.AC activity to detect any prior compromise.
How severe is CVE-2009-0238?
CVE-2009-0238 is rated HIGH with a CVSS 3.1 score of 8.8 and leads to full arbitrary code execution with HIGH impact on confidentiality, integrity, and availability. Its EPSS score of 81.1% sits in the 99.164th percentile, and CISA requires federal agencies to remediate by 2026-04-28, a deadline every organization running legacy Microsoft Office Excel should adopt for its own remediation plan.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.