CVE-2009-0563: Microsoft Word stack buffer overflow via crafted document tag

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe vulnerability is in CISA KEV with a high EPSS score and allows remote code execution via a common attack vector (malicious document), posing an immediate risk to unpatched systems.

What it is

A stack-based buffer overflow exists in Microsoft Word and related Office components when parsing a Word document containing a crafted tag with an invalid length field. Successful exploitation allows remote code execution in the context of the user who opens the document. The flaw affects multiple Word versions and viewers, making it broadly relevant to document-handling environments.

Impact

An attacker can execute arbitrary code with the privileges of the user who opens the malicious document. This can lead to full system compromise, data theft, or installation of malware.

Attack surface

The vulnerability is reached by opening a specially crafted Word document, requiring user interaction (UI:R) and no authentication (PR:N). The CVSS vector indicates local access (AV:L), consistent with opening a file on the target system.

Exploitation

CVE-2009-0563 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08), indicating active exploitation in the wild. EPSS probability is 0.63081 (99.16th percentile), reflecting a high likelihood of exploitation.

What to do

• Apply the Microsoft security update referenced in MS09-027 immediately.
• Disable or restrict the use of affected Word versions and viewers where patching is not possible.
• Use Microsoft Office File Block policies to prevent opening untrusted Word documents.
• Educate users not to open unexpected or unsolicited Word attachments.
• Consider application whitelisting and endpoint detection to block malicious document execution.

Detection

• Monitor for Word processes spawning child processes such as cmd.exe or powershell.exe.
• Inspect Word documents for malformed tags or invalid length fields using static analysis or sandboxing.
• Review endpoint logs for unusual file writes or network connections originating from WINWORD.EXE.
• Use YARA rules to detect known exploit patterns in Word documents.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.