← CVE Radar
CVE-2009-0556Microsoft Office PowerPoint Code Injection Vulnerability
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
8.8 HIGHEPSS 67.31%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 9.3 | HIGH | 2.0NVD | AV:N/AC:M/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Jan 28, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2009-0556
- Status
- Analyzed
- Assigner (CNA)
- microsoft
- Published
- Apr 3, 2009
- Last modified
- 2026-06-16 23:05 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
microsoftoffice powerpoint1 version range
- 2004
microsoftpowerpoint3 version ranges
- 2000 sp3
- 2002 sp3
- 2003 sp3
References
- blogs.technet.com http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx
- blogs.technet.com http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx
- blogs.technet.com http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx
- osvdb.org http://osvdb.org/53182
- secunia.com http://secunia.com/advisories/34572
- kb.cert.org http://www.kb.cert.org/vuls/id/627331
- microsoft.com http://www.microsoft.com/technet/security/advisory/969136.mspx
- securityfocus.com http://www.securityfocus.com/archive/1/503453/100/0/threaded
- securityfocus.com http://www.securityfocus.com/bid/34351
- securitytracker.com http://www.securitytracker.com/id?1021967
- us-cert.gov http://www.us-cert.gov/cas/techalerts/TA09-132A.html
- vupen.com http://www.vupen.com/english/advisories/2009/0915
- vupen.com http://www.vupen.com/english/advisories/2009/1290
- zerodayinitiative.com http://www.zerodayinitiative.com/advisories/ZDI-09-019
- docs.microsoft.com https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/49632
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556