{"id":"CVE-2009-0556","published":"2009-04-03T18:30:00Z","modified":"2026-06-16T23:05:17Z","title":"Microsoft Office PowerPoint Code Injection Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka \"Memory Corruption Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a code injection vulnerability in Microsoft Office PowerPoint, affecting PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, where an OutlineTextRefAtom with an invalid index value triggers memory corruption. A remote attacker can execute arbitrary code by getting a victim to open a specially crafted PowerPoint file, which requires user interaction but no authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:30Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.67312,"percentile":0.99301,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2026-01-07","dueDate":"2026-01-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 ; https://nvd.nist.gov/vuln/detail/CVE-2009-0556","provenance":"source"},"vulncheckKev":{"dateAdded":"2009-04-03","exploitedFirstSeen":"2009-04-03","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0556","date":"2009-04-03"},{"url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017","date":"2009-06-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-01-07"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx","tags":["Vendor Advisory"]},{"url":"http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx","tags":["Vendor Advisory"]},{"url":"http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx","tags":["Vendor Advisory"]},{"url":"http://osvdb.org/53182","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/34572","tags":["Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/627331","tags":["US Government Resource"]},{"url":"http://www.microsoft.com/technet/security/advisory/969136.mspx","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/503453/100/0/threaded","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/34351","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1021967","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-132A.html","tags":["US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2009/0915","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1290","tags":["Broken Link"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-09-019","tags":["Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017","tags":["Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49632","tags":["Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204","tags":["Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279","tags":["Broken Link"]},{"url":"http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx","tags":["Vendor Advisory"]},{"url":"http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx","tags":["Vendor Advisory"]},{"url":"http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx","tags":["Vendor Advisory"]},{"url":"http://osvdb.org/53182","tags":["Broken Link"]},{"url":"http://secunia.com/advisories/34572","tags":["Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/627331","tags":["US Government Resource"]},{"url":"http://www.microsoft.com/technet/security/advisory/969136.mspx","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/503453/100/0/threaded","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/34351","tags":["Broken Link"]},{"url":"http://www.securitytracker.com/id?1021967","tags":["Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-132A.html","tags":["US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2009/0915","tags":["Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1290","tags":["Broken Link"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-09-019","tags":["Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017","tags":["Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49632","tags":["Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204","tags":["Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Victim must open malicious PowerPoint file","mappingType":"uncategorized","evidence":[{"from":"description","quote":"via a PowerPoint file with an OutlineTextRefAtom","start":161,"end":209}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Memory corruption yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code","start":111,"end":160}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2009-0560","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0560","exploited":true,"exploitedSince":"2026-01-07","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2009-04-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0556","provenance":"source"},{"date":"2009-04-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2009-0556","provenance":"source"},{"date":"2026-01-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-01-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0560","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":6123},"priority":{"score":64.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 6418 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9930"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-94"}}