CVE-2009-3129highunder attackCWE-787

CVE-2009-3129

Published · Updated

Follow this CVE+ Monitor Microsoft Excel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 84%
from disclosure to weapon283 days
Published on NVDNov 11
1st PoC+283d
metasploitNov 10
CISA KEV+4495d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT12🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

Microsoft Excel fails to properly validate the size of data in a specific record type when opening spreadsheets, allowing attackers to corrupt memory and run malicious code by sending a specially crafted Excel file.

Technical detail

A memory corruption vulnerability exists in Excel's FEATHEADER record parsing due to improper validation of the cbHdrData size element, leading to incorrect pointer offset calculation. Remote attackers can exploit this via a malicious spreadsheet to achieve arbitrary code execution with the privileges of the user opening the file.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.