CVE-2009-0238VulnerabilityPublished 04/14/2026Updated 10/24/2026
CVE-2009-0238: Microsoft Office Remote Code Execution
Affects Microsoft OfficeSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 04/14/2026
- KEV deadline
- 04/28/2026
- EPSS
- 42.9% chance of exploitation in 30 days – higher than 98% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.