Which products and versions are affected by CVE-2009-0238?

Affected: Excel (Microsoft) versions 2000-sp3, 2002-sp3, 2003-sp3, 2007-sp1; Excel Viewer (Microsoft); Office (Microsoft) versions 2004, 2008, among others. The full list is in the CVE brief.

Is CVE-2009-0238 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 25, 2009.

Is CVE-2009-0238 in the CISA KEV catalog?

Yes. It was added on Apr 14, 2026 with a federal remediation due date of Apr 28, 2026.

Is there a public exploit for CVE-2009-0238?

Public exploit code is available.

Is there a fix for CVE-2009-0238?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2009-0238 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2009-0238

HighExploitedPublic exploit

Published Feb 25, 2009 · Updated Apr 22, 2026

Key Facts

Patch immediately

CVE-2009-0238 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Excel (Microsoft), Excel Viewer (Microsoft), Office (Microsoft) and 2 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 25, 2009. Public exploit code is available.
EPSS estimates a 43% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

43%

Higher than 98.7% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2009-0238 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Apr 14, 2026	Apr 28, 2026	Not reported
Industry KEV feed	Feb 25, 2009	Apr 28, 2026	Not reported
CIRCL KEV	Feb 25, 2009	Apr 28, 2026	Not reported
ENISA EUVD	Apr 14, 2026	n/a	Not reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

10 affected entries in total

Product	Affected versions	Fixed in
ExcelMicrosoft	2000-sp3, 2002-sp3, 2003-sp3, 2007-sp1	n/a
Excel ViewerMicrosoft	See advisory	n/a
OfficeMicrosoft	2004, 2008	n/a
Office Compatibility PackMicrosoft	2007-sp1	n/a
Office Excel ViewerMicrosoft	2003-sp3	n/a

Timeline

Publicly disclosed
Feb 25, 2009
Added to Industry KEV feed
Feb 25, 2009
Added to CIRCL KEV
Feb 25, 2009
Added to CISA KEV
Apr 14, 2026
Added to ENISA EUVD
Apr 14, 2026
Last updated
Apr 22, 2026

Weakness Type

CWE-94 Improper Control of Generation of Code ('Code Injection')

References

advisoryMS09-009
advisoryms-excel-unspecified-code-execution(48875)
advisoryhttp://www.microsoft.com/technet/security/advisory/968272.mspx
exploitVulnCheck exploitation report
exploitVulnCheck exploitation report

10 more references in the full CVE brief

FAQ

Common Questions.

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document th…
Affected: Excel (Microsoft) versions 2000-sp3, 2002-sp3, 2003-sp3, 2007-sp1; Excel Viewer (Microsoft); Office (Microsoft) versions 2004, 2008, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 25, 2009.
Yes. It was added on Apr 14, 2026 with a federal remediation due date of Apr 28, 2026.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2009-0238 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.