CVE-2009-1534 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 51.6% (pctl 99)
Patch early
A public exploit exists.
Description
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 51.61% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-08-12 |
| Last modified | 2026-06-16 |
Affected (5)
| Vendor | Product |
|---|---|
| microsoft | biztalk server |
| microsoft | isa server |
| microsoft | office |
| microsoft | office web components |
| microsoft | visual studio .net |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043) (Metasploit) | 2010-04-30 |
References
- http://osvdb.org/56916
- http://www.securityfocus.com/bid/35992
- http://www.securitytracker.com/id?1022708
- http://www.us-cert.gov/cas/techalerts/TA09-223A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326
- http://osvdb.org/56916
- http://www.securityfocus.com/bid/35992
- http://www.securitytracker.com/id?1022708
- http://www.us-cert.gov/cas/techalerts/TA09-223A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326
→ the Explorer · watch your stack · NVD