CVE-2009-0238 – Critical Remote Code Execution in Microsoft Office Excel (CISA KEV)

The CVE-2009-0238 vulnerability is a Critical remote code execution (RCE) flaw affecting legacy versions of Microsoft Office Excel and related components. In April 2026 the U.S. CISA KEV catalog added this 17‑year‑old bug, confirming active exploitation in the wild.

Key Takeaways

CVE-2009-0238 scores CVSS 2.0 9.3 (Critical) and CVSS 3.1 8.8 (High).

Exploits execute arbitrary code when a victim opens a crafted Excel file.

Affected products include Microsoft Excel 2000‑2007, Excel Viewer, and Office for Mac 2004/2008.

The vulnerability is now listed in the CISA KEV catalog with confirmed active exploitation.

Immediate patch or mitigation is required; unsupported versions should be retired.

Overview

The flaw was originally disclosed in 2009 (MS09‑009) and was exploited by the Trojan.Mdropper.AC in February 2009. Although Microsoft released patches, many legacy installations remain in use, especially in air‑gapped or legacy environments. The recent inclusion in the CISA Known Exploited Vulnerabilities (KEV) list signals that threat actors have revived the exploit chain, targeting organizations that still run the vulnerable Office components.

Technical Details

The vulnerability resides in the way Excel parses a specially crafted object stream. A malicious file triggers an access attempt on an invalid object, leading to memory corruption and code injection (CWE‑94). Successful exploitation grants the attacker full control of the host system with the privileges of the logged‑in user.

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2: AV:N/AC:M/Au:N/C:C/I:C/A:C (score 9.3)
CWE: CWE‑94 – Improper Control of Generation of Code (Code Injection)

Severity & Impact

The vulnerability enables remote code execution without authentication. An attacker who convinces a user to open a malicious Excel document can execute arbitrary commands, install malware, and move laterally within the network. The impact is complete system compromise (confidentiality, integrity, and availability).

Affected Products

Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP3, 2007 SP1
Excel Viewer (2003 Gold, SP3)
Microsoft Office for Mac 2004 and 2008
Office Compatibility Pack 2007 SP1

For the exhaustive list of affected versions, see the VulnSocial CVE page.

Actionable Insights / What to Do

Inventory: Identify any installations of the affected Excel/Office versions across your environment.
Version Check: Verify the exact version and service‑pack level.
Patch: Deploy the Microsoft security update MS09‑009 (or later cumulative updates) to all vulnerable systems.
Mitigate: If patching is impossible, disable macro execution and restrict opening of Excel files from untrusted sources via Group Policy or the Office Trust Center.
Network Controls: Block known malicious Excel file hashes and malicious URLs at email gateways and web proxies.
Monitor: Subscribe to CISA KEV alerts and watch real‑time threat signals on the VulnSocial page: https://vulnsocial.com/cve/CVE-2009-0238.

Remediation & Mitigation

Inventory – Use PowerShell to enumerate installed Excel versions:

Get-ItemProperty -Path "HKLM:\\Software\\Microsoft\\Office\\*\\Excel\\InstallRoot" | Select-Object PSChildName, Path

Patch – Apply the Microsoft security bulletin MS09‑009 (or later).
Mitigate – Disable macros on unpatched systems via Group Policy: User Configuration → Administrative Templates → Microsoft Excel 2007 → Disable all macros without notification.
Network Controls – Enforce file‑type filtering and hash‑based blocking for known malicious Excel payloads.
Monitor – Track exploitation activity on the VulnSocial timeline and watch for new IOCs.

Bottom Line

CVE-2009-0238 is a Critical RCE flaw in legacy Microsoft Excel that is actively exploited today. Organizations must patch immediately or retire vulnerable software to prevent full system compromise.