CVE-2009-1534
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office...
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
CVE-2009-1534- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
CVE-2009-1534- Updated
- 2026-11-02
EUVDEUVD-2009-1530 No score
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
EUVD-2009-1530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5vwg-gcr8-f2hf No score
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office...
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
GHSA-5vwg-gcr8-f2hf- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043) (Metasploit) | 2010-04-30 |
| Metasploit | Microsoft OWC Spreadsheet HTMLURL Buffer Overflow | 2009-08-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1534 is a high vulnerability (CVSS 9.3) in Microsoft Office, published August 12, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 51.6%, the 98th percentile. No source names a fixed version.
References
osvdb.org/56916
us-cert.gov/cas/techalerts/TA09-223A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326
securityfocus.com/bid/35992
securitytracker.com/id?1022708
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
nvd.nist.gov/vuln/detail/CVE-2009-1534
github.com/advisories/GHSA-5vwg-gcr8-f2hf