CVE-2009-2496 in the critical feed json
Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Componen…
published 2009-08-12 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2491
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 29.5%
- EPSS 29.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka "Office Web Components Heap Corruption Vulnerability."
Exploit prediction
29.46% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2009/ms09-043
vendor-advisory
-
us-cert.gov
/cas/techalerts/TA09-223A.html
third-party-advisory, us-government-resource
-
securitytracker.com
/id?1022708
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5645
vdb-entry, signature
Sources
- CVE List CVE-2009-2496
- NVD CVE-2009-2496
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.