Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2009-3129 Details

Description

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA: CISA-ADPCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3129 CISA-ADPUS Government Resource
http://archives.neohapsis.com/archives/bugtraq/2009-11/0080.html CVEBroken Link
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=832 CVEBroken Link
http://osvdb.org/59860 CVEBroken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 CVEPatchVendor Advisory

see all 21 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability NameDate AddedDue DateRequired Action
Microsoft Excel Featheader Record Memory Corruption VulnerabilityMar 3, 2022Mar 24, 2022Apply updates per vendor instructions.

Weakness Enumeration

CWE-IDCWE NameSource
CWE-787Out-of-bounds Write[email protected]
CWE-787Out-of-bounds WriteCISA-ADP

Affected Products

ProductVersions
microsoft excel
2002 sp3
2003 sp3
2007 sp1
2007 sp2

CPE

  • cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*

Remediation

  • No remediation found in references.
microsoft excel viewer
2003 sp3

CPE

  • cpe:2.3:a:microsoft:excel_viewer:-:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel_viewer:-:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*

Remediation

  • No remediation found in references.
microsoft office
2004
2008

CPE

  • cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
  • cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*

Remediation

  • No remediation found in references.
microsoft open xml file format converter
All versions

CPE

  • cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:*:*:*:macos:*:*

Remediation

  • No remediation found in references.

Change History

15 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2009-3129
NVD Published Date:
Nov 11, 2009
NVD Last Modified:
Jun 16, 2026
Source:
[email protected]
CVE-2009-3129 Details - Not Deferred