GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art…
Priority MEDIUM 59CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."
Why it matters now
EPSS 0.20452 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 57
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
Show 47 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:* | 1.1 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:* | 2.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* | 2.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* | 6 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:* | 2005 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:* | 2008 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:report_viewer:2008:sp1:redistributable_package:*:*:*:*:* | 2008 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:* | 2005 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium:*:*:*:*:* | 2005 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp2:x64:*:*:*:*:* | 2005 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:*:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:itanium:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2005:sp3:x64:*:*:*:*:* | 2005 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:* | 2000 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* | 2003 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:* | 2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:xp:*:*:*:*:*:*:* | xp | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:* | 2007 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_groove:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp1:*:*:*:*:*:* | 2007 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp2:*:*:*:*:*:* | 2007 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:* | 2002 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:* | 2002 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:* | 2003 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word_viewer:2003:sp3:*:*:*:*:*:* | 2003 sp3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:* | 8.5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:* | all versions | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:* | 2008 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:* | 2008 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* | 2003 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_.net:2005:sp1:*:*:*:*:*:* | 2005 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* | 8.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* | 9.0 sp2 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:* Versions 1.1 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:* Versions 2.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* Versions 6 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:* Versions 2005 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:* Versions 2008 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:report_viewer:2008:sp1:redistributable_package:*:*:*:*:* Versions 2008 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:* Versions 2005 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium:*:*:*:*:* Versions 2005 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp2:x64:*:*:*:*:* Versions 2005 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:*:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:itanium:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2005:sp3:x64:*:*:*:*:* Versions 2005 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:* Versions 2000 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* Versions 2003 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:xp:*:*:*:*:*:*:* Versions xp Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:* Versions 2007 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_groove:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp1:*:*:*:*:*:* Versions 2007 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp2:*:*:*:*:*:* Versions 2007 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:* Versions 2002 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:* Versions 2002 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:* Versions 2003 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word_viewer:2003:sp3:*:*:*:*:*:* Versions 2003 sp3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:* Versions 8.5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:* Versions 2008 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:* Versions 2008 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* Versions 2003 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_.net:2005:sp1:*:*:*:*:*:* Versions 2005 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* Versions 8.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2528
- 2026-10-03 Alias added: GHSA-qq8p-5v5h-rxf8
References
Other 1
More Microsoft .net Framework vulnerabilities
- TI-2020-00622 XML injection in Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
- TI-2017-06273 Code injection in Microsoft .NET Framework KEVCVSS 3.1HIGH 7.8
- TI-2015-01495 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1… KEVCVSS 3.1HIGH 7.8
- TI-2024-19239 .NET Framework Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-18684 ASP.NET Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2009-2528 · CVE Program
- CVE-2009-2528 · NVD
- FIRST EPSS
- GHSA-qq8p-5v5h-rxf8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences