CVE-2009-0556 Microsoft Office PowerPoint Code Injection

Exploited in the wild High 8.8 Published 3 Apr 2009 Updated 8 Jan 2026

Remote attackers can execute arbitrary code via a malicious PowerPoint file exploiting memory corruption in Microsoft Office PowerPoint.

Exploited in the wild: Since 7 Jan 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2009-0556?

CVE-2009-0556 is a high-severity memory corruption vulnerability in Microsoft Powerpoint, published on 3 Apr 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

Weakness: CWE-94

Which versions are affected by CVE-2009-0556?

It affects 2 products.

Products include Microsoft Office Powerpoint, Microsoft Powerpoint.

How do I fix CVE-2009-0556?

No fix has been published for CVE-2009-0556 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Jan 2026.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2009-0556 being exploited?

Yes. Attackers have exploited CVE-2009-0556 in the wild since at least 7 Jan 2026.

All Microsoft Powerpoint vulnerabilities

Sources

Also known as GHSA-w25v-2mf8-86hr.