CVE-2009-0556: Microsoft Office PowerPoint Code Injection Vulnerability
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
Other sources
Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Microsoft PowerPointfrom your environment.Discontinue use or uninstall the product if mitigations are unavailable.
- Remove
Remove
Microsoft PowerPoint 2010from your environment.Discontinue use or uninstall the product if mitigations are unavailable.
- Compensating control
Apply mitigations per vendor instructions and follow applicable BOD 22-01 guidance for cloud services.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0556?
CVE-2009-0556 has a critical severity rating as it allows remote attackers to execute arbitrary code.
How do I fix CVE-2009-0556?
To fix CVE-2009-0556, users should install the latest security updates provided by Microsoft.
What versions of PowerPoint are affected by CVE-2009-0556?
CVE-2009-0556 affects Microsoft PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint 2004 for Mac.
What kind of attack does CVE-2009-0556 enable?
CVE-2009-0556 enables remote code execution via specially crafted PowerPoint files.
Is CVE-2009-0556 still a threat today?
While it's less common now, CVE-2009-0556 can still pose a threat if outdated software is used.