Skip to content
COOEY

EXPOSURES › CVE-2009-0556

CVE-2009-0556

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2026-01-07 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2009-0556 ↗
⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 rceexploited-in-wildunpatched

Microsoft Office PowerPoint allowed remote code execution through a vulnerability in its software.

A critical code injection vulnerability in Microsoft Office PowerPoint allowed remote attackers to execute arbitrary code via a malicious PowerPoint file, posing a high risk to DIB organizations.

Shame score — Critical remote code execution vulnerability actively exploited in the wild.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

DESCRIPTION

Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.

AFFECTED FEDRAMP PRODUCTS · 4
PRODUCTSTATUS
Azure Commercial Cloud
Microsoft
Authorized
Azure Government (includes Dynamics 365)
Microsoft
Authorized
Microsoft Office 365 GCC High
Microsoft
In Process
Office 365 Multi-Tenant & Supporting Services
Microsoft
Authorized