CVE-2009-0562 in the critical feed json
The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Compon…
published 2009-08-12 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0566
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 25.7%
- EPSS 25.7% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office Web Components Memory Allocation Vulnerability."
Exploit prediction
25.65% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2009/ms09-043
vendor-advisory
-
us-cert.gov
/cas/techalerts/TA09-223A.html
third-party-advisory, us-government-resource
-
securitytracker.com
/id?1022708
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6337
vdb-entry, signature
Sources
- CVE List CVE-2009-0562
- NVD CVE-2009-0562
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.