U.S. CISA adds HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities (KEV) catalog, listing CVE-2009-0556 for Microsoft Office PowerPoint Code Injection Vulnerability and CVE-2025-37164 for HPE OneView Code Injection Vulnerability.

CVE-2009-0556 is a memory corruption flaw in legacy PowerPoint that allows attackers to execute arbitrary code via a crafted .ppt file; an invalid OutlineTextRefAtom triggers improper memory handling when the file is opened, and it was exploited in the wild in April 2009 (Exploit:Win32/Apptom[.]gen), affecting PowerPoint 2000/2002/2003 and Office 2004 for Mac, enabling full compromise with user privileges.

The advisory states that Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and PowerPoint in Office 2004 for Mac allow remote attackers to execute arbitrary code via a PowerPoint file containing an invalid OutlineTextRefAtom value. In December, Hewlett Packard Enterprise addressed a maximum-severity vulnerability tracked as CVE-2025-37164 in OneView Software, which could be exploited to achieve remote code execution.

CISA’s requirements reference the Binding Operational Directive 22-01, with agencies urged to address identified vulnerabilities by the due date, while private organisations are advised to review the KEV Catalog and remediate accordingly.