CVE-2009-0556VulnerabilityPublished 01/07/2026Updated 10/24/2026
CVE-2009-0556: Microsoft Office PowerPoint Code Injection Vulnerability
Affects Microsoft OfficeSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 01/07/2026
- KEV deadline
- 01/28/2026
- EPSS
- 67.3% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.