CVE-2009-0561
CVE-2009-0561 is a critical-severity vulnerability in Microsoft Office with a CVSS 2.0 base score of 9.3. Its EPSS exploit-prediction score of 37% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-189.
Key facts
- Severity: Critical (CVSS 2.0 base score 9.3)
- EPSS exploit prediction: 37% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-189
- Affected product: Microsoft Office
- Published:
- Last modified:
Description
Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Microsoft Office SharePoint Server 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via an Excel file with a Shared String Table (SST) record with a numeric field that specifies an invalid number of unique strings, which triggers a heap-based buffer overflow, aka "Record Integer Overflow Vulnerability."
Frequently asked questions
- What is CVE-2009-0561?
- Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Microsoft Office SharePoint Server 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via an Excel file with a Shared String Table (SST) record with a numeric field that specifies an invalid number of unique strings, which triggers a heap-based buffer overflow, aka "Record Integer Overflow Vulnerability."
- How severe is CVE-2009-0561?
- CVE-2009-0561 has a CVSS 2.0 base score of 9.3, rated critical severity.
- Is CVE-2009-0561 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 37% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-0561?
- CVE-2009-0561 primarily affects Microsoft Office. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-0561?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2009-0561 published?
- CVE-2009-0561 was published on 2009-06-10 and last updated on 2026-06-16.
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=805
- http://osvdb.org/54957
- http://secunia.com/secunia_research/2009-12/
- http://www.securityfocus.com/archive/1/504190/100/0/threaded
- http://www.securityfocus.com/bid/35245
- http://www.securitytracker.com/id?1022351
- http://www.us-cert.gov/cas/techalerts/TA09-160A.html
- http://www.vupen.com/english/advisories/2009/1540
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5925
Affected products (16)
- cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:x32:*:*:*:*:*
- cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:x64:*:*:*:*:*
- cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x32:*:*:*:*:*
- cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x64:*:*:*:*:*
- cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*
More vulnerabilities in Microsoft Office
- CVE-2007-0065 — Critical (CVSS 10.0): Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2,…
- CVE-2003-0347 — Critical (CVSS 10.0): Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3…
- CVE-2000-0854 — Critical (CVSS 10.0): When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as…
- CVE-2025-53766 — Critical (CVSS 9.8): Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2023-23397 — Critical (CVSS 9.8): Microsoft Outlook Elevation of Privilege Vulnerability
- CVE-2023-21716 — Critical (CVSS 9.8): Microsoft Word Remote Code Execution Vulnerability
All CVEs affecting Microsoft Office →
Other CWE-189 (Numeric Errors) vulnerabilities
- CVE-2015-8396 — Critical (CVSS 10.0): Integer overflow in the ImageRegionReader::ReadIntoBuffer function in…
- CVE-2015-7205 — Critical (CVSS 10.0): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x…
- CVE-2015-6575 — Critical (CVSS 10.0): SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which…
- CVE-2015-3864 — Critical (CVSS 10.0): Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in…
- CVE-2015-3836 — Critical (CVSS 10.0): The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1…
- CVE-2015-3834 — Critical (CVSS 10.0): Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android…