CVE-2009-0238

What is Microsoft Excel?

Microsoft Excel is the world's most widely used spreadsheet application, part of the Microsoft Office suite. It is deployed across virtually every enterprise sector — finance, healthcare, government, and logistics — making it a perennial high-value target for threat actors. The ability to weaponize Excel files and deliver them via email or file share enables broad phishing campaigns with minimal technical barrier to entry for the attacker.

Overview

CVE-2009-0238 is a remote code execution vulnerability in Microsoft Office Excel. Exploitation requires a user to open a specially crafted Excel file; when the malicious document is processed, Excel attempts to access an invalid object in memory, triggering memory corruption that allows an attacker to execute arbitrary code in the context of the logged-in user. The attack is delivered via email attachment or malicious download — no server-side exposure is required.

The vulnerability's re-emergence in 2026 underscores a persistent threat pattern: legacy Office vulnerabilities continue to be weaponized years or decades after patching because a significant subset of enterprise and government environments still run unpatched or legacy Office versions, and because phishing with malicious Office documents remains a dominant initial access technique.

Affected Versions

All versions listed above received patches in Microsoft Security Bulletin MS09-009 (Critical), released April 14, 2009.

Technical Details

The root cause is Excel's failure to validate object references before accessing them during document parsing. When a specially crafted .xls or .xlsx document is opened, Excel dereferences a pointer to an invalid or freed object in memory. This triggers memory corruption that an attacker can control to redirect execution flow.

The attack chain is straightforward: craft a malicious Excel document → deliver via spearphishing email → victim opens attachment → arbitrary code runs on victim's system.

Discovery

The vulnerability was first observed being exploited in the wild in February 2009, before any patch existed, making the original exploitation a zero-day attack. Microsoft acknowledged active exploitation in its security bulletin at the time of patching (April 2009). The initial attacker tooling was identified by Symantec as Trojan.Mdropper.AC — a dropper/loader designed to download and execute secondary malware payloads on the compromised host.

The 2026 re-exploitation that prompted the CISA KEV addition represents a new wave of active attacks leveraging the same underlying flaw in unpatched or legacy systems.

Exploitation Context

This vulnerability has a notable dual-exploitation timeline:

2009 (Original Zero-Day): Exploited by Trojan.Mdropper.AC as part of targeted attacks before Microsoft could issue a patch. The malware functioned as a first-stage loader, dropping additional payloads for persistent access.

2026 (Re-Emergence): CISA's KEV listing on April 14, 2026 — the same day as Microsoft's April Patch Tuesday — confirms fresh exploitation activity. The Register reported on the re-emergence under the headline "Ancient Excel bug comes out of retirement for active attacks." This pattern — where patched-but-ancient vulnerabilities are re-exploited — is increasingly common as threat actors target organizations that have fallen behind on patching legacy Office installs or still run Office 2003/2007-era software in isolated environments.

The simultaneous KEV listing with SharePoint CVE-2026-32201 on April 14, 2026 suggests a broader Microsoft-focused exploitation campaign may be underway.

Remediation

1. Apply MS09-009 immediately if not already done — available from Microsoft Learn. Any Office 2007 or earlier installation that has not received all cumulative updates is at risk.
2. Upgrade legacy Office versions — Office 2007 and earlier are long past end-of-life and no longer receive security updates. Upgrade to a supported Microsoft 365 or Office 2021+ version.
3. Enable Protected View in Excel (File → Options → Trust Center → Protected View) — this opens files from the internet and email in a sandboxed read-only mode that blocks exploitation without user action.
4. Block macro execution — while this CVE doesn't require macros, disabling VBA macros via Group Policy reduces the overall Office attack surface.
5. Train users to not open unexpected Excel attachments — this vulnerability requires user interaction; awareness is a meaningful control.
6. Review endpoint detection logs for suspicious Excel process spawning (e.g., EXCEL.EXE spawning cmd.exe, powershell.exe, or network-connecting processes), which may indicate active exploitation.