How to Fix CVE-2009-0557: Excel Object Record Corruption RCE (MS09-021)

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately with MS09-021. CISA's Known Exploited Vulnerabilities catalog lists this CVE (added 2022-06-08, federal remediation due 2022-06-22), which means working attack code is in active use. This is a client-side, file-open bug: a single crafted spreadsheet that a user opens is enough to run code as that user.

What is CVE-2009-0557?

CVE-2009-0557 is a remote code execution vulnerability in the Excel file parser shipped with Microsoft Office. Microsoft calls it the “Object Record Corruption Vulnerability.” When Excel reads a legacy binary workbook (the BIFF-format .xls file), it walks a stream of records that each describe a piece of the document — a cell, a formula, a chart object, a drawing, and so on. CVE-2009-0557 is triggered by a record object that has been deliberately malformed so that Excel mishandles it during parsing, corrupting memory in a way an attacker can steer toward running arbitrary code.

The official MITRE description is precise about scope: “Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object.” The breadth matters: it is not only the full Excel application that is vulnerable, but also the free Excel Viewer and the Office Compatibility Pack, because they share the same record-parsing code.

Classified as CWE-94 (code injection / arbitrary code execution), the practical effect is that opening one booby-trapped spreadsheet lets the attacker execute code with the privileges of the logged-on user. If that user is a local administrator, the attacker effectively owns the machine.

How an attack actually reaches you

Read the CVSS 3.1 vector carefully, because it dictates how you defend this: AV:L / AC:L / PR:N / UI:R / S:U / C:H / I:H / A:H. The attack vector is local and user interaction is required. There is no listening network service to firewall here. The vulnerable code only runs when a person opens or previews a malicious .xls file with Excel, the Excel Viewer, or an application that uses the Compatibility Pack to read Excel content.

That changes the realistic attack chain. An attacker emails the crafted spreadsheet as an attachment, links to it from a web page, or drops it on a shared drive, then relies on someone double-clicking it. Because confidentiality, integrity, and availability impacts are all High and the technical impact is rated total in CISA's SSVC assessment, a single click can mean full code execution in the victim's session. This is the classic targeted-phishing weaponization pattern that made Office file-format bugs of this era so valuable to attackers.

Am I affected?

Office did not, and does not, run natively on Linux, so there is nothing to check with dpkg or rpm here. Check the actual Microsoft products that ship the vulnerable Excel parser. On Windows, read the file version of the Excel binary and the supporting converter DLLs.

# List installed Office / Excel components and their versions (Windows)
Get-CimInstance Win32_Product |
  Where-Object { $_.Name -match 'Excel|Office|Compatibility Pack|File Format Converter' } |
  Select-Object Name, Version | Format-Table -AutoSize

# Read the file version of the Excel executable directly (path varies by Office version)
Get-ChildItem 'C:\Program Files*\Microsoft Office' -Recurse -Filter EXCEL.EXE -ErrorAction SilentlyContinue |
  ForEach-Object { [PSCustomObject]@{ Path = $_.FullName; Version = $_.VersionInfo.FileVersion } }

If any of the products in the “Affected” row of the at-a-glance table are present and have not received the MS09-021 update, that installation is vulnerable. Note that the Excel Viewer and the Office Compatibility Pack are commonly installed on machines that do not have full Office, and they are in scope too.

How to fix CVE-2009-0557

The fix is Microsoft security update MS09-021, released 9 June 2009. There is no configuration toggle that closes the underlying flaw — you must install the patched Excel/converter binaries for every affected product on the machine. Because the bug lives in shared parsing code, a host with both full Excel and the Compatibility Pack needs the update for both.

Recommended: install via Microsoft Update

The simplest and most reliable path is Microsoft Update (or WSUS / your patch-management tool), which will offer the correct MS09-021 package for each affected Office product it detects.

# Trigger a Microsoft Update scan + install (run as administrator)
# This pulls the right MS09-021 package(s) for whatever Office products are installed.
Install-Module -Name PSWindowsUpdate -Force -SkipPublisherCheck -Confirm:$false
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate            # review what is offered, look for the Office/Excel security update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot

Manual: download the MS09-021 package from the Update Catalog

For offline or tightly controlled environments, pull the per-product package from the Microsoft Update Catalog. Search the catalog for MS09-021 (or for the KB number listed against your specific Office product in the bulletin), then apply the .exe/.msp for each affected product.

# Apply a downloaded Office security update package silently (example for an Office .exe self-installer)
# Replace the filename with the exact package you downloaded for your Office version from the catalog.
Start-Process -FilePath 'C:\Patches\office2007-kb-fullfile-x86-glb.exe' -ArgumentList '/quiet','/norestart' -Wait

# Or, for an .msp patch (older Office installers):
Start-Process msiexec.exe -ArgumentList '/p','C:\Patches\excel-ms09-021.msp','/qn','/norestart' -Wait

The exact KB numbers differ per product (Office 2000 SP3, Office XP SP3, Office 2003 SP3, the 2007 Office system SP1/SP2, Excel Viewer, Excel Viewer 2003 SP3, and the Compatibility Pack each have their own update). The authoritative mapping is in the MS09-021 bulletin's “Affected Software” table — use that to confirm you are installing the right package for each component on the host.

Office for Mac

Office 2004 and Office 2008 for Mac, and the Open XML File Format Converter for Mac, are also affected. Apply the corresponding Office for Mac update through Microsoft AutoUpdate (Help → Check for Updates inside an Office for Mac application), or download the standalone updater Microsoft published alongside MS09-021.

If you can't patch immediately

Patching with MS09-021 is the only durable fix. Until it is deployed, reduce the chance that a crafted spreadsheet ever reaches a vulnerable parser. These are exposure-reduction measures for a client-side file bug — firewall port rules and WAF signatures do nothing here, because no network service is involved.

• Block legacy .xls at the mail gateway for users who do not need it, or quarantine spreadsheets from external senders for review.
• Use the Microsoft Office Isolated Conversion Environment (MOICE) where available, so binary Office files are converted in a sandboxed, hardened process before they reach Excel.
• Open untrusted spreadsheets in the Excel Viewer only inside a low-privilege or sandboxed account, and never as a local administrator — the impact of CVE-2009-0557 is bounded by the privileges of the user who opens the file.
• Use the File Block / file-type restriction policy in Office to prevent opening older binary Excel formats from untrusted locations until the patch is in place.

How to verify the fix worked

After installing MS09-021, confirm that the patched update is actually registered and that the Excel binaries report a fixed file version.

# Confirm the Office security update is recorded as installed (Windows)
Get-CimInstance Win32_QuickFixEngineering |
  Where-Object { $_.Description -match 'Security Update' } |
  Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 10

# Re-read the Excel file version and compare against the fixed build named in MS09-021
Get-ChildItem 'C:\Program Files*\Microsoft Office' -Recurse -Filter EXCEL.EXE -ErrorAction SilentlyContinue |
  ForEach-Object { $_.VersionInfo.FileVersion }

Then run an authenticated vulnerability scan with a current signature set and confirm the scanner no longer flags CVE-2009-0557 on the host. If users in your environment opened spreadsheets from untrusted sources during the unpatched window, treat those endpoints as suspect: review process-creation and persistence artifacts (new scheduled tasks, run-key entries, unexpected outbound connections) and reset credentials that a compromised user session could have exposed.

Frequently asked questions

Which update fixes CVE-2009-0557?

Microsoft security bulletin MS09-021, released on 9 June 2009. It ships per-product Excel updates for every affected component — Office 2000/XP/2003, the 2007 Office system, Excel Viewer, Excel Viewer 2003, the Office Compatibility Pack, and Office 2004/2008 for Mac. Install the update for each affected product present on the machine.

Can CVE-2009-0557 be exploited remotely without a user opening a file?

No. The CVSS vector is AV:L/UI:R, meaning the attack is local and requires user interaction. A victim must open or preview a crafted .xls file. The realistic delivery is a malicious spreadsheet by email, web download, or file share, so attachment filtering and user awareness matter alongside the patch.

Is CVE-2009-0557 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-08, confirming observed active exploitation. CISA's SSVC assessment scores exploitation as active with total technical impact.

I only have the Excel Viewer or Compatibility Pack, not full Excel. Am I affected?

Yes. MS09-021 explicitly patches the Microsoft Office Excel Viewer, Excel Viewer 2003 SP3, and the Office Compatibility Pack SP1/SP2, because they parse the same Excel record structures. Anything that opens .xls content is in scope, even without the full Excel application.

References

• Official vendor advisory: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2009-0557
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0557
• Additional reference: http://www.vupen.com/english/advisories/2009/1540
• Additional reference: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5564
• Additional reference: http://www.securitytracker.com/id?1022351
• Additional reference: http://osvdb.org/54953

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2009-1123: Security vulnerability in Microsoft Windows
• How to Fix CVE-2009-0556: Memory Corruption in Office
• How to Fix CVE-2009-3129: Out-of-bounds write in Microsoft Office
• How to Fix CVE-2009-0563: Out-of-bounds Write in Office
• How to Fix CVE-2009-0238: Remote Code Execution in Office