LiveActive security incident?Get immediate response
CVE Record

CVE-2009-0556: Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for M...

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

HighCVSS 8.8Known exploitedUpdated
Discuss exposureBack to CVEs
Glexia's Takehigh

Analyst readout for executives and security teams

Plain-English summary

A malicious PowerPoint file can corrupt memory in older Microsoft PowerPoint versions and run attacker-controlled code after a user opens it. This is not theoretical: the source bundle says it was exploited in April 2009, and CISA KEV marks the CVE as known exploited.

Executive priority

Prioritize remediation if legacy Office exists in the business, especially on systems receiving external documents. The main urgency is not broad modern exposure, but high impact and known exploitation if old PowerPoint remains in use.

Technical view

CVE-2009-0556 is a PowerPoint OutlineTextRefAtom parsing memory corruption issue triggered by an invalid index value. The CVSS 3.1 vector is 8.8, network-reachable with required user interaction, no privileges, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is limited to environments that still have the named legacy PowerPoint versions or compatible vulnerable components: PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, or Office 2004 for Mac PowerPoint.

Exploitation context

The bundle reports in-the-wild exploitation in April 2009 using malicious PowerPoint files and names Exploit:Win32/Apptom.gen. CISA KEV status supports treating any remaining exposure as operationally important despite the CVE's age.

Researcher notes

The provided source bundle does not include full vendor package applicability details beyond the named products. Validate against Microsoft MS09-017 and OVAL definitions, and avoid assuming exposure in newer Office versions without supporting evidence.

Mitigation direction

  • Apply Microsoft MS09-017 guidance for affected PowerPoint installations.
  • Remove or replace named legacy PowerPoint versions where still present.
  • Restrict unexpected PowerPoint attachments from untrusted senders.
  • Use vendor guidance for any unsupported or unclear Office configuration.

Validation and detection

  • Inventory endpoints for the named PowerPoint versions.
  • Verify MS09-017 or equivalent vendor update status.
  • Review email and endpoint alerts for Exploit:Win32/Apptom.gen references.
  • Check whether PowerPoint file handling remains exposed on legacy systems.
Prepared
Confidence
high
Sources
8

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2009-0556 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
Yes
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
20Source links

CISA KEV status

Status
Known exploited
Source
CISA / ADP
Date added
Not provided

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2009-0556Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-94

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-94 · source CWE mapping

Improper Control of Generation of Code ('Code Injection')

Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs