CVE-2009-2528

Published: Oct 14, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."

Affected (56)

Products: Microsoft: Windows 2003 Server, Windows Server 2008, Windows Vista, Windows Xp, .net Framework, Internet Explorer, Sql Server, Sql Server Reporting Services, Excel Viewer, Expression Web, Office, Office Compatibility Pack, Office Excel Viewer, Office Groove, Office Powerpoint Viewer, Office Word Viewer, Project, Visio, Word Viewer, Works, Platform Sdk, Report Viewer, Visual Studio, Visual Studio .net, Forefront Client Security, Visual Foxpro

26 products

Sql Server Reporting Services

Excel Viewer

Expression Web

Office

Office Compatibility Pack

Office Excel Viewer

Office Groove

Office Powerpoint Viewer

Forefront Client Security

Visual Foxpro

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 1.1 sp1
Microsoft .net Framework	Version 2.0 sp1
Microsoft .net Framework	Version 2.0 sp2
Microsoft Internet Explorer	Version 6 sp1

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql Server	Version 2005 sp2
Microsoft Sql Server	Version 2005 sp2
Microsoft Sql Server	Version 2005 sp2
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server Reporting Services	Version 2000 sp2

Configuration D

22 vulnerable

Vulnerable Software	Affected Versions
Microsoft Excel Viewer	Version 2003
Microsoft Excel Viewer	Version 2003 sp3
Microsoft Expression Web	All versions
Microsoft Expression Web	Version 2
Microsoft Office	Version 2003 sp3
Microsoft Office	Version 2007 sp1
Microsoft Office	Version 2007 sp2
Microsoft Office	Version xp
Microsoft Office Compatibility Pack	Version 2007 sp1
Microsoft Office Compatibility Pack	Version 2007 sp2
Microsoft Office Excel Viewer	All versions
Microsoft Office Groove	Version 2007
Microsoft Office Groove	Version 2007 sp1
Microsoft Office Powerpoint Viewer	All versions
Microsoft Office Powerpoint Viewer	Version 2007 sp1
Microsoft Office Powerpoint Viewer	Version 2007 sp2
Microsoft Office Word Viewer	All versions
Microsoft Project	Version 2002 sp1
Microsoft Visio	Version 2002 sp2
Microsoft Word Viewer	Version 2003
Microsoft Word Viewer	Version 2003 sp3
Microsoft Works	Version 8.5

Configuration E

8 vulnerable

Vulnerable Software	Affected Versions
Microsoft Platform Sdk	All versions
Microsoft Report Viewer	Version 2005 sp1
Microsoft Report Viewer	Version 2008
Microsoft Report Viewer	Version 2008 sp1
Microsoft Visual Studio	Version 2008
Microsoft Visual Studio	Version 2008 sp1
Microsoft Visual Studio .net	Version 2003 sp1
Microsoft Visual Studio .net	Version 2005 sp1