CVE-2009-3129: Microsoft Excel Featheader Record Memory Corruption Vulnerability
CVE-2009-3129 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2022-03-03
Microsoft Excel is vulnerable to memory corruption when processing a FEATHEADER record with an invalid cbHdrData size element. This flaw affects the pointer offset calculation, allowing remote attackers to execute arbitrary code via a specially crafted spreadsheet.
Yes. CVE-2009-3129 is known to be exploited in the wild, first recorded on 3 March 2022. Treat it as urgent.
How severe is CVE-2009-3129?
Critical severity, with a CVSS score of 9.3, published 3 March 2022.
Which products and versions are affected?
Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP1, 2007 SP2; Microsoft Office for Mac 2004, 2008; Microsoft Open XML File Format Converter for Mac; Microsoft Excel Viewer 2003 SP3; and 2 more.
Is there a fix for CVE-2009-3129?
A patch was published on 2009-11-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2009-3129 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2009-3129?
Check whether you run Microsoft Excel. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP1, 2007 SP2
Microsoft Office for Mac 2004, 2008
Microsoft Open XML File Format Converter for Mac
Microsoft Excel Viewer 2003 SP3
Microsoft Excel Viewer SP1, SP2
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, SP2
Timeline
2009-11-10: advisory: Microsoft Security Bulletin MS09-067 published
2009-11-10: patched
2022-03-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2022-03-03: disclosed: NVD publication date listed in advisory