$ cve CVE-2009-1136 JSON

CVE-2009-1136 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 62% (pctl 99)

Patch early

A public exploit exists.

Description

The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	62.02% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2009-07-15
Last modified	2026-06-16

Affected (4)

Vendor	Product
microsoft	isa server
microsoft	office
microsoft	office web components
microsoft	office xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Office Web Components (OWC) Spreadsheet - msDataSourceObject Memory Corruption (MS09-043) (Metasploit)	2010-07-20
exploit-db	Microsoft Office Web Components (OWC) Spreadsheet - ActiveX Buffer Overflow (PoC)	2009-07-16

References

→ the Explorer · watch your stack · NVD