CVE-2009-3129: microsoft excel +3 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2009-3129

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 84,0%

Kerentanan Out-of-bounds Write pada microsoft excel, microsoft excel viewer +2 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

Rincian

Terbit di NVD: 11 November 2009
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 84,0% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft Excel Featheader Record Memory Corruption Vulnerability
Masuk KEV: 3 Maret 2022
Tenggat CISA: 24 Maret 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	excel	Versi 2002 sp3
microsoft	excel	Versi 2003 sp3
microsoft	excel	Versi 2007 sp1
microsoft	excel	Versi 2007 sp2
microsoft	excel viewer	Semua versi
microsoft	excel viewer	Versi 2003 sp3
microsoft	office	Versi 2004
microsoft	office	Versi 2008
microsoft	open xml file format converter	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 patch · advisory vendor
http://www.us-cert.gov/cas/techalerts/TA09-314A.html advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3129 pemerintah AS
http://www.exploit-db.com/exploits/14706 exploit · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/36945 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1023157 broken link · advisory pihak ketiga · vdb entry
http://www.zerodayinitiative.com/advisories/ZDI-09-083 advisory pihak ketiga · vdb entry
http://archives.neohapsis.com/archives/bugtraq/2009-11/0080.html broken link
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=832 broken link
http://osvdb.org/59860 broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6521 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.