CVE-2009-0238: Microsoft Excel invalid object access allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in-the-wild exploitation, KEV listing, and a CVSS 8.8 remote code execution impact make this a high-priority item despite the age of the affected products.

What it is

Microsoft Excel and related viewers (Excel 2000 through 2007, Excel Viewer, Office Compatibility Pack, and Office for Mac 2004/2008) fail to handle a crafted Excel document that triggers an access attempt on an invalid object. Successful exploitation lets a remote attacker run arbitrary code in the context of the opening user. The flaw was exploited in the wild in February 2009 via Trojan.Mdropper.AC, and CISA added it to the KEV catalog.

Impact

An attacker gains arbitrary code execution with the privileges of the user who opens the malicious spreadsheet, enabling malware installation and full host compromise. No privilege escalation beyond the user's own rights is described.

Attack surface

Reached by delivering a crafted Excel document to a victim, who must open it in a vulnerable Excel or viewer product; the CVSS vector shows network delivery with user interaction required and no authentication (AV:N/AC:L/PR:N/UI:R). No server-side or unauthenticated network path is described.

Exploitation

Exploitation is confirmed: the description states it was exploited in the wild in February 2009, and CISA KEV lists it with a 2026-04-14 addition. EPSS is 0.432 (98.7th percentile), indicating high predicted activity.

What to do

• Apply the Microsoft MS09-009 update to all affected Excel, Excel Viewer, Compatibility Pack, and Office for Mac installations.
• If patching is not possible, follow CISA KEV required action: apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use of the affected product.
• Block or strip untrusted Excel attachments at email and web gateways, and disable automatic opening of Office documents from external sources.
• Restrict users from opening documents from untrusted locations and enforce Mark-of-the-Web/Protected View where supported.
• Retire end-of-life Excel 2000/2002/2003 and viewer components that no longer receive security updates.

Detection

• Monitor for Excel or Excel Viewer processes spawning child processes such as cmd.exe, powershell.exe, or script hosts, which is abnormal for document viewing.
• Alert on Office applications writing executables or DLLs to user-writable paths or startup folders shortly after a document is opened.
• Hunt for known Trojan.Mdropper.AC file indicators and for Excel documents with malformed object structures using endpoint and email gateway telemetry.
• Correlate email attachment delivery of .xls files with subsequent process creation events on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.