CVE-2009-3129

A remote code execution vulnerability in Microsoft Excel allows attackers to execute arbitrary code via a malicious spreadsheet file.

This memory corruption flaw in Excel's FEATHEADER record processing enables remote code execution without user interaction, making it a critical threat to DIB organizations relying on Office for document handling. The vulnerability was actively exploited in the wild (KEV), indicating attackers are leveraging it for ransomware or data exfiltration campaigns. DIBs must ensure all Office products are patched to the latest version and restrict macro execution to mitigate this risk.

Shame score — A known, actively exploited memory corruption vulnerability in a widely used productivity tool that enables remote code execution, representing a severe avoidable risk for any organization.