Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word
Affects Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3 and 2007 SP1, plus Excel Viewer; on 2007 SP1 the Compatibility Pack update is also needed. Fixed by KB959964.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in KB959964
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Microsoft Excel, the Excel Viewer, the Compatibility Pack for Word, Excel, and PowerPoint file formats, and Excel for Mac are affected. An attacker could run arbitrary code on a user's system by getting them to open a specially crafted Excel document.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 11
microsoft.com
vupen.com
exchange.xforce.ibmcloud.com
us-cert.gov
securityfocus.com
docs.microsoft.com
oval.cisecurity.org
isc.sans.org
securitytracker.com
blogs.zdnet.com
Questions about CVE-2009-0238
What does this mean?
The flaws allow remote code execution. An attacker could take complete control of an affected system, install programs, view, change or delete data, or create new accounts with full user rights.Source: learn.microsoft.com
Am I affected, and how do I check?
The bulletin lists Excel 2000 SP3, 2002 SP3, 2003 SP3 and 2007 SP1, Office 2004 and 2008 for Mac, and Excel Viewer 2003 Gold and SP3. On Excel 2007 SP1, the Microsoft Office Compatibility Pack security update must also be installed. To check a version, open Help or About in the Excel application.Source: learn.microsoft.com
What should I do about it?
Install the security update KB959964 for the affected Excel version. On Excel 2007 SP1, also install the security update for Microsoft Office Compatibility Pack.Source: learn.microsoft.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-14, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data