CVE-2009-1534
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office...
CVE-2009-1534 is a high vulnerability (CVSS 9.3) in Microsoft Office, published August 12, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 51.6%, the 98th percentile. No source names a fixed version.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 51.6%EPSS, 98th percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Microsoft OWC Spreadsheet HTMLURL Buffer Overflow | 2009-08-11 |
| Exploit-DB | Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043) (Metasploit) | 2010-04-30 |
What each source reports
NVD Score used
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
CVE-2009-1534- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
CVE-2009-1534- Updated
- 2026-11-02
EUVDEUVD-2009-1530No score
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
EUVD-2009-1530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5vwg-gcr8-f2hfNo score
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office...
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
- Record
GHSA-5vwg-gcr8-f2hf- Weakness
- CWE-119
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
osvdb.org/56916
us-cert.gov/cas/techalerts/TA09-223A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326
securityfocus.com/bid/35992
securitytracker.com/id?1022708
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
nvd.nist.gov/vuln/detail/CVE-2009-1534
github.com/advisories/GHSA-5vwg-gcr8-f2hf