Log in Start free

Actively exploited · Published Apr 3, 2009 · Assigned by microsoft

CVE-2009-0556

High 8.8 Exploited

In plain English

A high-severity code injection in Office from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on January 7, 2026). The chance it is exploited in the next 30 days is estimated at 67.3% (higher than 99.3% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)67.3%top 0.7% of all CVEs
Exploited in the wildYesCISA KEV since Jan 7, 2026
Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Jan 28, 2026.

Official description

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References