Executive brief
Microsoft Excel is a widely used spreadsheet application for data analysis and reporting. A vulnerability exists where an attacker can take full control of a user's computer if the user opens a specially crafted Excel file. This could lead to the theft of sensitive data, installation of malware, or complete disruption of business operations.
Technical details
A remote code execution vulnerability exists in multiple versions of Microsoft Excel due to improper handling of objects within Excel documents. The flaw is triggered when the application attempts to access an invalid object within a malformed file, leading to memory corruption or code injection (CWE-94). An attacker can exploit this by tricking a user into opening a malicious .xls file, typically delivered via email or a malicious website. Successful exploitation allows for arbitrary code execution in the context of the logged-in user. This vulnerability was notably exploited in the wild by the Trojan.Mdropper.AC malware. Patches were released by Microsoft under security bulletin MS09-009.
Affected products
- Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP3, 2007 SP1
- Microsoft Excel Viewer 2003 Gold and SP3
- Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1
- Microsoft Office for Mac 2004, 2008
Timeline
- 2009-02-23: exploited: Exploited in the wild by Trojan.Mdropper.AC
- 2009-04-14: advisory: Microsoft released security bulletin MS09-009
- 2026-04-14: kev added: Added to CISA Known Exploited Vulnerabilities Catalog