Vulnerability intelligence

CVE-2009-0238

Microsoft Office Remote Code Execution

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

CVSS Score

8.8

High

EPSS — Exploit Probability

43%

Riskier than 99% of all CVEs

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

Patch available

Federal deadline 2026-04-28

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-04-28.

NVD entry Vendor patch PoC / advisory CISA KEV

3 articles across 3 outlets · first covered Apr 14, 2026 · latest Apr 15, 2026

Coverage timeline

CISA adds old Excel RCE and SharePoint flaw to KEV list
securityaffairs.com · Apr 15, 2026
CISA Adds CVE-2009-0238 Excel Flaw to KEV Catalog, Urges Patching
www.cisa.gov · Apr 14, 2026
CISA Flags 2009 Excel Flaw CVE‑2009‑0238 as Actively Exploited
cisa.gov · Apr 14, 2026

Related CVEs — Microsoft

CVE-2026-45659KEV CVE-2026-33825KEV CVE-2026-42897KEV CVE-2026-41091KEV CVE-2008-4250KEV CVE-2009-1537KEV CVE-2010-0249KEV CVE-2010-0806KEV