CVE-2009-1136: Microsoft Office Web Components ActiveX control remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw allows unauthenticated remote code execution, has public exploit code, was exploited in the wild, and carries a very high EPSS score, though it is not in CISA KEV.

What it is

The Microsoft Office Web Components Spreadsheet ActiveX control (OWC10/OWC11) can be abused through a crafted call to the msDataSourceObject method when loaded in Internet Explorer. Successful exploitation lets a remote attacker run arbitrary code in the context of the logged-on user, and the flaw was exploited in the wild in July and August 2009.

Impact

An attacker gains arbitrary code execution on the victim's machine with the privileges of the user running Internet Explorer. That can lead to full system compromise, data theft, or installation of additional malware.

Attack surface

Reached over the network by luring a user to a malicious or compromised web page that instantiates the vulnerable ActiveX control in Internet Explorer. No authentication is required, but user interaction (visiting the page) is needed, matching the AV:N/AC:M/Au:N vector.

Exploitation

Public exploit code exists (Metasploit module and a public blog reference tagged Exploit), and the description states the vulnerability was exploited in the wild in July and August 2009. It is not listed in CISA KEV, but EPSS is very high at 0.6202 (99.1st percentile).

What to do

• Apply Microsoft security bulletin MS09-043 (or the corresponding update) to affected Office, Office Web Components, ISA Server, and Office Small Business Accounting installations.
• Disable or kill-bit the Office Web Components Spreadsheet ActiveX control in Internet Explorer where it is not required.
• Restrict Internet Explorer use of ActiveX controls and enforce consistent browser security zones for untrusted sites.
• Remove or upgrade unsupported Office XP/2003 and OWC components that are no longer needed.

Detection

• Monitor for Internet Explorer processes loading OWC10/OWC11 ActiveX controls, especially from untrusted or newly registered domains.
• Hunt for suspicious child processes spawned by iexplore.exe, such as cmd.exe, powershell.exe, or script hosts.
• Review proxy and web logs for known exploit-hosting URLs or patterns associated with the Metasploit owc_spreadsheet_msdso module.
• Alert on unexpected creation or registration of Office Web Components control files outside normal patch or install activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.