CVE-2009-0225

CVE-2009-0225 is a critical-severity vulnerability in Microsoft Office Powerpoint with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-94.

Key facts

• Severity: Critical (CVSS 2.0 base score 9.3)
• EPSS exploit prediction: 31% (98th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-94
• Affected product: Microsoft Office Powerpoint
• Published: 2009-05-12
• Last modified: 2026-06-16

Description

Microsoft Office PowerPoint 2002 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format, leading to improper "array indexing" and memory corruption, aka "PP7 Memory Corruption Vulnerability."

Frequently asked questions

What is CVE-2009-0225?

Microsoft Office PowerPoint 2002 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format, leading to improper "array indexing" and memory corruption, aka "PP7 Memory Corruption Vulnerability."

How severe is CVE-2009-0225?

CVE-2009-0225 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2009-0225 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-0225?

CVE-2009-0225 affects Microsoft Office Powerpoint. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2009-0225?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2009-0225 published?

CVE-2009-0225 was published on 2009-05-12 and last updated on 2026-06-16.

References

• http://osvdb.org/54388
• http://secunia.com/advisories/32428
• http://www.securityfocus.com/bid/34880
• http://www.securitytracker.com/id?1022205
• http://www.us-cert.gov/cas/techalerts/TA09-132A.html
• http://www.vupen.com/english/advisories/2009/1290
• http://www.vupen.com/exploits/Microsoft_PowerPoint_Array_Indexing_Code_Execution_Exploit_MS09_017_1290125.php
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5526

Affected products (1)

• cpe:2.3:a:microsoft:office_powerpoint:2002:sp3:*:*:*:*:*:*

More vulnerabilities in Microsoft Office Powerpoint

• CVE-2009-0202 — Critical (CVSS 9.3): Array index error in FL21WIN.DLL in the PowerPoint Freelance Windows 2.1 Translator in Microsoft PowerPoint 2000 and…
• CVE-2009-1137 — Critical (CVSS 9.3): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via…
• CVE-2009-1131 — Critical (CVSS 9.3): Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute…
• CVE-2009-1130 — Critical (CVSS 9.3): Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office…
• CVE-2009-1129 — Critical (CVSS 9.3): Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000…
• CVE-2009-1128 — Critical (CVSS 9.3): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via…

All CVEs affecting Microsoft Office Powerpoint →

Other CWE-94 (Code Injection) vulnerabilities

• CVE-2026-76605 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
• CVE-2026-76604 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The…
• CVE-2026-67364 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1:…
• CVE-2026-73343 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
• CVE-2026-74253 — Critical (CVSS 10.0): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0…
• CVE-2026-73678 — Critical (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that…

Browse all CWE-94 (Code Injection) vulnerabilities →