Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offic
Affects Excel 2003 SP3 and Excel 2007 SP1 and SP2, with the 2007 fix also requiring Compatibility Pack KB973704. Security updates are listed for Excel 2002 SP3 (KB973471), 2003 SP3 (KB973475), and 2007 (KB973593).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in Microsoft Office Excel 2002 Service Pack 3 (KB973471)
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Microsoft Excel and related Office components, including Excel Viewer, the Compatibility Pack, and the Open XML File Format Converter, are affected. An attacker could exploit this by tricking a user into opening a specially crafted spreadsheet, allowing them to run arbitrary code on the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 10
osvdb.org
oval.cisecurity.org
securitytracker.com
securityfocus.com
us-cert.gov
labs.idefense.com
docs.microsoft.com
archives.neohapsis.com
zerodayinitiative.com
Exploit-DB
Questions about CVE-2009-3129
What does this mean?
A specially crafted Excel file can allow remote code execution when a user opens it. The code runs with the same user rights as the local user.Source: learn.microsoft.com
Am I affected, and how do I check?
The advisory lists Excel 2002 SP3, Excel 2003 SP3, and Excel 2007 SP1 and SP2, along with Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac. To check a Windows install, open Excel and look at Help > About for the version and service pack.Source: learn.microsoft.com
What should I do about it?
Install the security update for your Excel version: KB973471 for Excel 2002 SP3, KB973475 for Excel 2003 SP3, or KB973593 for Excel 2007. On Excel 2007 SP1 or SP2, also install Compatibility Pack KB973704.Source: learn.microsoft.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
Why do the sources disagree?
The description says the flaw is reached by a remote file, but the CVSS vector is marked as local access (AV:L). The facts do not settle which of these describes how the attack is delivered.Source: learn.microsoft.com