CVE-2009-0556

Microsoft Office PowerPoint Code Injection

8.8 HIGHActively exploited (CISA KEV)EPSS 67.3%

Published3 Apr 2009
Added to CISA KEV7 Jan 2026
Remediation due28 Jan 2026

Description

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Microsoft Office Powerpoint2004

Microsoft Powerpoint2000 · 2002 · 2003

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspxVendor Advisory
http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspxVendor Advisory
http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspxVendor Advisory
http://osvdb.org/53182Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017Vendor Advisory
http://secunia.com/advisories/34572Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49632Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556US Government Resource

and 9 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2009-0556 being actively exploited?

Yes. CVE-2009-0556 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 7 Jan 2026.

How severe is CVE-2009-0556?

CVE-2009-0556 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 67.3% probability of exploitation.

Which products are affected by CVE-2009-0556?

Affected products include Microsoft Office Powerpoint, Microsoft Powerpoint.

How do I fix CVE-2009-0556?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2009-0556 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Running Microsoft 365?

Patching is one half. Scan your domain and check MFA, legacy authentication, admin roles and mail forwarding in two minutes, with a fix for every gap.

Run the free Microsoft 365 check

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.