Is CVE-2009-0556 actively exploited?

Yes. CVE-2009-0556 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2009-0556 be exploited remotely?

Yes. CVE-2009-0556 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2009-0556?

CVE-2009-0556 has a CVSS score of 8.8 (HIGH) and an EPSS exploitation probability of 78.21%.

HOME VULNERABILITIESCVE-2009-0556

HIGHCISA KEVIN THE WILD

CVE-2009-0556

Published: January 7, 2026

8.8

CVSS v3.1

EPSS:78.21%probability of exploitation in 30 daysPercentile:99.0th

Official Description

Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.

NVD Source

CISA KEV Advisory

Microsoft Office PowerPoint Code Injection Vulnerability

Added to KEV: 2026-01-07Federal patch deadline: 2026-01-28

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This vulnerability in Microsoft Office PowerPoint allows remote attackers to execute arbitrary code by manipulating a PowerPoint file. With a CVSS score of 8.8 and an EPSS score of 0.78206, coupled with its presence in CISA's KEV, this flaw presents a critical risk due to its high likelihood of exploitation and potential for severe impact.

This vulnerability is actively being exploited in the wild. It is remotely exploitable, requiring user interaction to open a malicious PowerPoint file.

Recommended Action

Users should apply the latest security updates for Microsoft Office PowerPoint. Exercise caution when opening untrusted PowerPoint files and implement robust email and endpoint security measures.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2009-0556 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

CISA has added CVE-2009-0556 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.