CVEvulnerability

CVE-2009-2528

9.3 HIGH Published 2009-10-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-10-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-94

Description

GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."

Affected configurations

• microsoft windows 2003 server • microsoft windows server 2008 • microsoft windows vista • microsoft windows xp • microsoft .net framework 1.1 • microsoft .net framework 2.0 • microsoft internet explorer 6 • microsoft report viewer 2005 • microsoft report viewer 2008 • microsoft sql server 2005 • microsoft sql server reporting services 2000 • microsoft excel viewer 2003 • microsoft expression web • microsoft expression web 2 • microsoft office 2003 • microsoft office 2007 • microsoft office xp • microsoft office compatibility pack 2007 • microsoft office excel viewer • microsoft office groove 2007 • microsoft office powerpoint viewer • microsoft office powerpoint viewer 2007 • microsoft office word viewer • microsoft project 2002 • microsoft visio 2002 • microsoft word viewer 2003 • microsoft works 8.5 • microsoft platform sdk • microsoft visual studio 2008 • microsoft visual studio .net 2003 • microsoft visual studio .net 2005 • microsoft forefront client security 1.0 • microsoft visual foxpro 8.0 • microsoft visual foxpro 9.0

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References