Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3…
Priority MEDIUM 57CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted TIFF image file, aka "GDI+ TIFF Buffer Overflow Vulnerability."
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.22025 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 57
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
Show 47 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:* | 1.1 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:* | 2.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* | 2.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* | 6 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:* | 2005 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:* | 2008 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:report_viewer:2008:sp1:redistributable_package:*:*:*:*:* | 2008 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:* | 2005 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium:*:*:*:*:* | 2005 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp2:x64:*:*:*:*:* | 2005 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:*:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:itanium:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:x64:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:* | 2000 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* | 2003 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:* | 2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:xp:*:*:*:*:*:*:* | xp | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:* | 2007 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_groove:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:* | 2002 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:* | 2002 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:* | 2003 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word_viewer:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:* | 8.5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:* | 2008 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:* | 2008 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* | 2003 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_.net:2005:sp1:*:*:*:*:*:* | 2005 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* | 8.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* | 9.0 sp2 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:* Versions 1.1 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:* Versions 2.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* Versions 6 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:* Versions 2005 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:* Versions 2008 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:report_viewer:2008:sp1:redistributable_package:*:*:*:*:* Versions 2008 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:* Versions 2005 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium:*:*:*:*:* Versions 2005 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp2:x64:*:*:*:*:* Versions 2005 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:*:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:itanium:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:x64:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:* Versions 2000 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* Versions 2003 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:xp:*:*:*:*:*:*:* Versions xp Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:* Versions 2007 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_groove:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:* Versions 2002 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:* Versions 2002 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:* Versions 2003 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word_viewer:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:* Versions 8.5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:* Versions 2008 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:* Versions 2008 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* Versions 2003 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_.net:2005:sp1:*:*:*:*:*:* Versions 2005 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* Versions 8.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2502
- 2026-10-03 Alias added: GHSA-h99v-p65j-fpx4
References
Other 1
More Microsoft .net Framework vulnerabilities
- TI-2020-00622 XML injection in Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
- TI-2017-06273 Code injection in Microsoft .NET Framework KEVCVSS 3.1HIGH 7.8
- TI-2015-01495 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1… KEVCVSS 3.1HIGH 7.8
- TI-2024-19239 .NET Framework Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-18684 ASP.NET Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2009-2502 · CVE Program
- CVE-2009-2502 · NVD
- FIRST EPSS
- GHSA-h99v-p65j-fpx4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences