CVE-2009-3135

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 35.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-11-11 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in Microsoft Office Word 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, Office Word Viewer 2003 SP3, and Office Word Viewer allow remote attackers to execute arbitrary code via a Word document with a malformed File Information Block (FIB) structure, aka "Microsoft Office Word File Information Memory Corruption Vulnerability."

Affected products

Microsoft Office: 2004, 2008
Microsoft Office Word: 2002-sp3, 2003-sp3
Microsoft Office Word Viewer: 2003-sp3
Microsoft Open Xml File Format Converter: all versions

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=831
http://osvdb.org/59857
http://secunia.com/advisories/37277
http://www.securityfocus.com/bid/36950
http://www.securitytracker.com/id?1023158
http://www.us-cert.gov/cas/techalerts/TA09-314A.html
http://www.vupen.com/english/advisories/2009/3194
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-068
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6555
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=831
http://osvdb.org/59857
http://secunia.com/advisories/37277

Get alerted when CVE-2009-3135 or the next vulnerability affects your stack