CVE-2009-0557
Microsoft Office Object Record Corruption Vulnerability
Published Jun 10, 2009 · updated Jun 16, 2026 · microsoft office
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
Timeline
Detection, updates, and resolution for this record.
Jun 10, 2009 · Catalog
Detected
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute
Jun 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 22, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute
Required action
Apply updates per vendor instructions.
CISA due date Jun 22, 2022
Affected
- cpe microsoft/office2000
- cpe microsoft/office2003
- cpe microsoft/office2004
- cpe microsoft/office2007
- cpe microsoft/office2008
- cpe microsoft/officexp
- cpe microsoft/office compatibility pack2007
- vendor Microsoft Officeversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2009-0557
Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
cisa.gov - CVE.orgVulnerability recordCVE-2009-0557
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2009-0557
30-day exploitation probability 53.0%
first.org - NIST NVDVulnerability recordCVE-2009-0557
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Of
nvd.nist.gov