CVE-2009-0097: Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files,...

Security readout for executives and security teams

CVE-2009-0097 is a Microsoft Office Visio memory corruption issue. A malicious Visio file could allow arbitrary code execution in vulnerable Visio 2002 SP2 or Visio 2003 SP3 environments. The business risk is highest where legacy Visio is still used to open untrusted files. Likely exposure is limited to legacy systems running Microsoft Office Visio 2002 SP2 or Visio 2003 SP3 that process Visio files, especially from email, downloads, or external parties. The provided affected-product metadata is incomplete and lists n/a, so asset validation is important. Treat as high priority only if legacy Visio exists in the environment. If not present, document non-exposure. The main decision is whether to patch, isolate, or retire unsupported Visio installations that may still open external files. Mitigation focus: Review Microsoft MS09-005 for the official security update and deployment guidance.; Patch or retire affected legacy Visio installations where they still exist.; Restrict handling of untrusted Visio files until remediation is confirmed..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.