CVE-2009-0557

What is Microsoft Office Excel?

Microsoft Excel is the world's most widely used spreadsheet application, part of the Microsoft Office suite. The Excel binary format (.XLS — Binary Interchange File Format, or BIFF) is an intricate binary structure containing hundreds of record types for workbook data, formulas, charts, formatting, and metadata. This complexity made the XLS parser a rich target for security researchers and attackers, yielding dozens of memory corruption vulnerabilities over the 2005–2012 period. Excel files are routinely exchanged via email and shared drives, making malicious .XLS files a practical delivery mechanism for targeted attacks.

Overview

CVE-2009-0557 is a high-severity code execution vulnerability (CWE-94, CVSS 7.8) in Microsoft Office Excel. A crafted Excel file containing a malformed record object triggers memory corruption during parsing, enabling arbitrary code execution when the file is opened. Patched in Microsoft Security Bulletin MS09-021 (June 2009 Patch Tuesday). CISA added to KEV in June 2022 as part of a batch of legacy Office binary format vulnerabilities.

Affected Versions

Technical Details

The vulnerability exists in Excel's parsing of binary record objects within .XLS files. Excel's BIFF format contains numerous record types; some records contain embedded sub-objects with their own structure and layout. When parsing a crafted Excel file, the record parsing code processes an object record whose structure has been intentionally malformed — with invalid size fields, corrupt pointer values, or inconsistent internal state.

The malformed record object causes Excel's parsing logic to:

1. Misinterpret the size or layout of the object record
2. Perform a memory operation (read, write, or copy) with an incorrect offset or length
3. Corrupt adjacent heap memory or overwrite a return address or function pointer

Through heap spraying or careful memory layout control, an attacker can direct the corrupted execution to attacker-supplied code, achieving arbitrary code execution in the context of the user running Excel.

The "Local" attack vector CVSS metric reflects that the .XLS file must be opened on the victim's machine (delivered via email, download, or removable media) rather than being exploitable directly over the network.

Discovery

Identified through security research into Excel's binary format record handling and reported to Microsoft. MS09-021 addressed multiple Excel vulnerabilities, reflecting the systematic security review of the BIFF format parser that took place during this period.

Exploitation Context

Excel binary format vulnerabilities from this era were extensively weaponized:

• Targeted spear phishing: Malicious Excel spreadsheets sent to corporate finance, accounting, and executive targets — fake invoices, financial reports, budget documents — were a primary initial access vector in targeted corporate intrusions from 2007 to 2012.
• APT tooling: State-sponsored groups, particularly those attributed to China and Russia, incorporated Excel BIFF vulnerabilities into targeted attack chains against defense contractors, government agencies, and energy companies.
• Exploit kit inclusion: Criminal exploit kit operators included Excel vulnerabilities alongside PDF and Flash exploits to maximize delivery success rates against heterogeneous target populations.
• Legacy persistence: The June 2022 KEV addition reflects continued exploitation of systems running Office 2000–2003, long past their end-of-life dates.

Remediation

1. Apply MS09-021: Install the June 2009 Patch Tuesday cumulative update for all affected Office versions.
2. Upgrade off end-of-life Office: Office 2003 and earlier are unsupported. Upgrade to Microsoft 365 or a current perpetual Office version.
3. Enable Protected View: Modern Office versions open files from the internet and email in Protected View (sandbox mode), blocking exploitation of parser vulnerabilities.
4. Block legacy .XLS at email gateways: If legacy binary .XLS files are not required by business processes, block them at the email gateway and require .XLSX (Open XML format).
5. Email attachment scanning: Deploy email security that inspects Excel attachments for embedded exploit code.