CVE-2009-0238

HIGH

8.8

CVSS Score

Published: February 25, 2009 at 04:00 PM UTC

Updated: June 16, 2026 at 11:04 PM UTC

5 products affected across 1 vendorOfficeExcelOffice Compatibility Pack

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 43%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score42.9%

EPSS (Exploit Prediction Scoring System) estimates a 42.9% chance this CVE is exploited in the wild within the next 30 days — higher than 99% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Apr 14, 2026

Remediation Due

Apr 28, 2026

182 days overdue

Notes

https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009

https://nvd.nist.gov/vuln/detail/CVE-2009-0238

Description

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.