CVE-2009-0563
Microsoft Office Buffer Overflow Vulnerability
Description
CVE-2009-0563 is a buffer overflow vulnerability in Microsoft Office that allows remote attackers to execute arbitrary code via a Word document containing a crafted tag with an invalid length field. The flaw occurs when Office's document parser processes the malformed tag data, copying it into a fixed-size buffer without proper bounds checking, leading to a buffer overflow that can be leveraged for code execution. CISA has added CVE-2009-0563 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 79.9% (99th percentile), this vulnerability poses a critical risk to organizations running unpatched Office versions.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | office | 2000; 2003; 2004; 2007; 2008; xp |
| microsoft | office compatibility pack | 2007 |
| microsoft | office word viewer | -; 2003 |
| microsoft | open xml file format converter | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://osvdb.org/54959(Broken Link)
- http://www.securityfocus.com/archive/1/504204/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/35188(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1022356(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA09-160A.html(Broken Link, Third Party Advisory, US Government Resource)
- http://www.vupen.com/english/advisories/2009/1546(Broken Link)
- http://www.zerodayinitiative.com/advisories/ZDI-09-035(Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6133(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0563(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2009-0563 exploits a classic buffer overflow in Microsoft Office's document parsing routines, where the application processes a crafted tag with an invalid length field and copies the associated data into a buffer without verifying that the data size does not exceed the buffer capacity. This classic buffer overflow condition enables memory corruption and arbitrary code execution.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Impact Analysis
CVE-2009-0563 is remotely exploitable through a crafted Word document — an attacker needs only to convince a victim to open a malicious document delivered via email or web download. No authentication is required, though user interaction is needed to open the file. Successful exploitation results in arbitrary code execution with the privileges of the current user, which can lead to complete system compromise if the user has elevated privileges. Confidentiality, integrity, and availability are all at risk, as an attacker can exfiltrate data, deploy ransomware, or establish persistent access. The EPSS score of 79.9% (99th percentile) indicates a very high probability of active exploitation, particularly through spear-phishing campaigns targeting organizations with legacy Office installations.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2009-0563 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 8, 2022. The EPSS score of 79.9% places this vulnerability in the 99th percentile, indicating a very high probability of exploitation. The document-based attack vector through Word files makes this vulnerability well-suited for spear-phishing campaigns, where crafted documents can be delivered to specific targets via email. No specific ransomware association has been reported, but the remote code execution capability makes it suitable for any post-exploitation scenario.
Remediation
- Apply Microsoft security updates immediately: Install the relevant patches for Microsoft Office as directed by the CISA KEV required action to address the buffer overflow in document tag parsing.
- Upgrade legacy Office installations: If running Office 2000, 2003, or 2007, upgrade to a currently supported Office version with modern exploit mitigations including ASLR, DEP, and Control Flow Guard.
- Enable Protected View for Word documents: Ensure Microsoft Office Protected View is enabled for all documents received from external sources, which opens files in a restricted sandbox.
- Configure email gateway document inspection: Deploy email security solutions that perform deep content inspection of Word documents, scanning for malformed tag structures and known exploit signatures.
- Monitor for suspicious Word process behavior: Configure endpoint detection to alert on unusual Word process activity such as unexpected child process creation, network connections from winword.exe, or memory access violations.
Technical Details
CVE-2009-0563 is a buffer overflow vulnerability in Microsoft Office triggered by a crafted tag structure with an invalid length field within a Word document. When Office's document parser encounters the malformed tag, it reads the length field and uses it to determine how much data to copy into a pre-allocated buffer. Because the length field is crafted to specify a size larger than the buffer capacity, the copy operation overflows the buffer, overwriting adjacent memory including stack frames or heap structures. This classic buffer overflow condition (CWE-120) allows an attacker to overwrite return addresses or function pointers, redirecting execution to shellcode embedded within the document. The vulnerability specifically targets the tag parsing logic, which processes structural elements of the document format, making it a reliable exploitation target across different document content.
Frequently Asked Questions
Is CVE-2009-0563 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2009-0563 to the Known Exploited Vulnerabilities catalog. The EPSS score of 79.9% in the 99th percentile indicates a very high probability of ongoing exploitation through malicious Word documents.
What products are affected by CVE-2009-0563?
CVE-2009-0563 affects Microsoft Office, specifically the Word document parsing component. Multiple Office versions including Office 2000, 2003, and 2007 are known to be vulnerable.
How do I fix CVE-2009-0563?
Apply the Microsoft security updates for Office and upgrade to a currently supported version. Enable Protected View for all externally received documents and deploy email attachment scanning to detect malicious Word files.
How severe is CVE-2009-0563?
CVE-2009-0563 is a severe buffer overflow vulnerability with an EPSS score in the 99th percentile, enabling remote code execution through crafted Word documents. The prevalent use of Word documents in business communication makes this an effective vector for targeted attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.