CVE-2009-0556
Microsoft Office PowerPoint Code Injection Vulnerability
Description
CVE-2009-0556 is a high-severity code injection vulnerability (CVSS 8.8) in Microsoft Office PowerPoint, including PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac. The vulnerability allows remote attackers to execute arbitrary code through a maliciously crafted PowerPoint file containing an OutlineTextRefAtom with an invalid index value, triggering memory corruption. This vulnerability was actively exploited in the wild as early as April 2009 and has been added to CISA's KEV catalog with a remediation deadline of January 28, 2026. Its EPSS score of 0.78206 (99.0th percentile) reflects an extremely high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office powerpoint | 2004 |
| microsoft | powerpoint | 2000; 2002; 2003 |
References
- http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx(Vendor Advisory)
- http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx(Vendor Advisory)
- http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx(Vendor Advisory)
- http://osvdb.org/53182(Broken Link)
- http://secunia.com/advisories/34572(Vendor Advisory)
- http://www.kb.cert.org/vuls/id/627331(US Government Resource)
- http://www.microsoft.com/technet/security/advisory/969136.mspx(Patch, Vendor Advisory)
- http://www.securityfocus.com/archive/1/503453/100/0/threaded(Broken Link)
- http://www.securityfocus.com/bid/34351(Broken Link)
- http://www.securitytracker.com/id?1021967(Broken Link)
- http://www.us-cert.gov/cas/techalerts/TA09-132A.html(US Government Resource)
- http://www.vupen.com/english/advisories/2009/0915(Vendor Advisory)
- http://www.vupen.com/english/advisories/2009/1290(Broken Link)
- http://www.zerodayinitiative.com/advisories/ZDI-09-019(Third Party Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017(Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49632(Third Party Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204(Broken Link)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94 describes vulnerabilities where an application constructs code segments using externally-influenced input without properly neutralizing elements that could alter the code's intended behavior. In CVE-2009-0556, the PowerPoint file parser fails to validate the index value within the OutlineTextRefAtom structure, leading to memory corruption that an attacker can leverage to inject and execute arbitrary code. The root cause is insufficient bounds checking on a data structure index that directly influences memory access patterns during file parsing.
Impact Analysis
The business impact of CVE-2009-0556 remains relevant for organizations that still operate legacy Microsoft Office installations. Confidentiality is fully compromised because successful exploitation grants the attacker arbitrary code execution with the privileges of the user running PowerPoint, enabling access to all files and data accessible to that user. Integrity is fully compromised as the attacker can install malware, modify documents, and alter system configurations. Availability is also fully impacted since the attacker can crash the application, destroy data, or render the system unusable. The EPSS score of 0.78206 places this vulnerability in the 99.0th percentile, reflecting that exploitation tools and techniques are well-established and widely available. The vulnerability was exploited in the wild in April 2009 by the Exploit:Win32/Apptom.gen malware family, and its continued KEV listing with a January 2026 deadline indicates that CISA believes vulnerable systems still exist in government and critical infrastructure networks. Organizations maintaining legacy Office installations face serious risk, particularly because PowerPoint files are commonly shared via email and require only that the user open the file for exploitation to succeed.
Exploit Maturity
CVE-2009-0556 is a well-established, actively exploited vulnerability with a mature threat landscape. It was first exploited in the wild in April 2009 by the Exploit:Win32/Apptom.gen malware family and has been part of the threat landscape for over 16 years. Its inclusion in CISA's KEV catalog with a remediation deadline of January 28, 2026 indicates continued concern about exploitation against legacy systems. The EPSS score of 0.78206 (99.0th percentile) reflects the highest tier of exploitation probability, driven by the widespread availability of exploit code, long-standing public knowledge, and the simplicity of the attack vector (sending a crafted PowerPoint file). Microsoft published a security advisory and subsequent patches. The ransomware association is listed as unknown, but memory corruption vulnerabilities in Office applications are classic vectors for malware delivery, including ransomware droppers.
Remediation
- Upgrade to a supported version of Microsoft Office — PowerPoint 2000, 2002, 2003, and Office 2004 for Mac are all end-of-life products that no longer receive security updates. Migrate to a currently supported version of Microsoft 365 or Office to receive ongoing protection.
- Apply the original security patch if still on legacy software — If upgrading is not immediately feasible, ensure that the security update from Microsoft Security Advisory 969136 has been applied. Consult the Microsoft advisory for patch details.
- Block untrusted PowerPoint files at the email gateway — Configure email security solutions to quarantine or strip PowerPoint attachments (.ppt, .pps, .pot) from external or untrusted senders, as the attack vector requires the user to open a malicious file.
- Enable Microsoft Office Protected View — On newer Office versions, ensure Protected View is enabled so that documents from untrusted sources open in a sandboxed read-only mode that prevents code execution.
- Educate users about file-based attacks — Train users to avoid opening PowerPoint files from unknown or unexpected sources, and to report suspicious attachments to the security team.
Technical Details
The CVSS v3.1 vector for CVE-2009-0556 is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a base score of 8.8 (High). Attack Vector (Network) means the malicious PowerPoint file can be delivered remotely via email, web download, or file share. Attack Complexity (Low) indicates the exploit is reliable and does not depend on variable conditions. Privileges Required (None) means the attacker does not need any account on the target system. User Interaction (Required) means the victim must open the malicious PowerPoint file for exploitation to occur. Scope (Unchanged) indicates the impact stays within the user's security context. Confidentiality, Integrity, and Availability are all High, reflecting full system compromise at the user's privilege level. The technical mechanism involves a malformed OutlineTextRefAtom record within the PowerPoint binary file format. This atom contains an index value that references outline text data, but when the index is set to an invalid value, the PowerPoint parser uses it to calculate a memory offset without proper bounds checking. This leads to an out-of-bounds memory access that corrupts internal data structures. An attacker can carefully control the invalid index and surrounding file structures to redirect execution flow to attacker-controlled shellcode, achieving arbitrary code execution.
Frequently Asked Questions
Is CVE-2009-0556 still relevant in 2026?
Yes, despite being discovered in 2009, CISA has included it in the KEV catalog with a 2026 remediation deadline. This indicates that legacy PowerPoint installations still exist in government and critical infrastructure environments, and active exploitation continues to target them.
How does the attack work?
The attacker creates a specially crafted PowerPoint file containing a malformed OutlineTextRefAtom with an invalid index value. When a user opens this file, the invalid index triggers memory corruption in the PowerPoint parser, which the attacker leverages to execute arbitrary code on the victim's system.
Which versions of PowerPoint are affected?
Microsoft PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac are all affected. Modern versions of Microsoft Office (2010 and later) are not affected by this specific vulnerability.
What should organizations still running legacy Office do?
The strongest recommendation is to migrate to a supported version of Microsoft 365 or Office. If immediate migration is not possible, apply the original security patch, block external PowerPoint attachments at the email gateway, and restrict who can open untrusted files.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.