CVE-2009-1534: Microsoft Office Web Components ActiveX control buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is remotely exploitable with no authentication and a CVSS 2.0 score of 9.3, but the affected products are long unsupported and no active exploitation is recorded in KEV.

What it is

The Office Web Components ActiveX control contains a buffer overflow that is triggered by crafted property values. Because the control is loaded in the browser, a remote attacker can reach the flaw through a web page and run code in the context of the victim. The affected software is old and no longer supported, but the flaw is remotely exploitable and rated 9.3 under CVSS 2.0.

Impact

An attacker who triggers the overflow can execute arbitrary code with the privileges of the logged-on user. That gives full control of confidentiality, integrity and availability on the victim host.

Attack surface

The vector is AV:N/AC:M/Au:N, so it is reached over the network with no authentication, though some user action such as visiting a malicious page is implied by the medium access complexity. The description does not state whether the victim must instantiate the control, but ActiveX controls are typically loaded by a browsing user.

Exploitation

The record is not listed in CISA KEV and no ransomware groups are documented as using it. EPSS gives a 30-day probability of 0.5161 (98.9th percentile), and one reference is tagged Patch, indicating a fix exists but no public exploit is confirmed here.

What to do

• Apply Microsoft security bulletin MS09-043, which addresses this vulnerability.
• Disable or block the Office Web Components ActiveX control in Internet Explorer and other browsers that support ActiveX.
• Set the kill bit for the affected control's CLSID.
• Remove or upgrade unsupported Office 2000, Office XP, BizTalk Server 2002 and Visual Studio .NET 2003 installations.
• Restrict browsing to trusted sites and enforce least privilege for users who still need the affected software.

Detection

• Monitor for processes such as Internet Explorer or Office applications loading the Office Web Components ActiveX control unexpectedly.
• Look for crashes or memory corruption events in Office Web Components or related ActiveX host processes.
• Alert on network requests to pages that instantiate the affected control's CLSID.
• Review endpoint logs for child processes spawned by browser or Office processes, which can indicate successful exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.