Old PowerPoint flaw CVE-2009-0556 added to CISA's list of exploited vulnerabilities
CISA listed a 2009 PowerPoint flaw (CVE-2009-0556) as exploited on 7 Jan 2026. Microsoft fixed it in 2009 for PowerPoint 2000 to 2003 and Office 2004 for Mac. Anyone still running those old, unsupported versions should retire them and not open untrusted .ppt files.
If you still use PowerPoint 2000, 2002, 2003 or Office 2004 for Mac, move to a current supported version of Office, and install the MS09-017 update if you must keep an old one. Do not open .ppt files from people you don't know.
- Microsoft Office 2004 for Macfixed in MS09-017 update (KB969661) and later
- Microsoft PowerPoint 2003fixed in MS09-017 update (KB957784) and later
- Microsoft PowerPoint 2002fixed in MS09-017 update (KB957781) and later
- Microsoft PowerPoint 2000fixed in MS09-017 update (KB957790) and later
What’s happening
On 7 January 2026 the US cyber agency CISA added CVE-2009-0556 to its list of flaws known to be used in attacks. It is a memory-corruption flaw in the way old versions of Microsoft PowerPoint open specially crafted .ppt files. Someone who opens such a file can lose control of the computer to the attacker, who gets the same rights as the logged-in user. Microsoft's bulletin MS09-017, published in May 2009, lists PowerPoint 2000, 2002 and 2003 and Office 2004 for Mac as affected. It also lists updates for PowerPoint 2007 and Office 2008 for Mac, though the bulletin shows those two as not affected by this particular flaw. Microsoft released fixes in 2009, so a patch has existed for years. CISA gave no detail about who is exploiting it now or how. Press reports tie the flaw to attacks as far back as April 2009. The versions involved are very old and long unsupported, so the realistic risk is to anyone still running them.
- What
- Flaw
- Affects
- Microsoft PowerPoint 2000 to 2003 and Office 2004 for Mac (legacy versions)
- Affected
- Microsoft Office PowerPoint 2000 SP3
Microsoft Office PowerPoint 2002 SP3
Microsoft Office PowerPoint 2003 SP3
Microsoft Office 2004 for Mac - Fixed in
- MS09-017: KB957790 (PowerPoint 2000 SP3)
KB957781 (PowerPoint 2002 SP3)
KB957784 (PowerPoint 2003 SP3)
KB969661 (Office 2004 for Mac) - Since
- 7 Jan 2026
- Closed
- 23 Jan 2026
Timeline
- Update
LevelBlue's SpiderLabs noted the flaw dates from 2009 and named no attackers or 2026 campaigns. It argued that unpatched legacy systems keep old attacks workable.
- CISA added
CISA added CVE-2009-0556 to its Known Exploited Vulnerabilities catalogue, a listing that means attacks are known. Reports say federal agencies were given until 28 January 2026 to deal with it. CISA gave no details of current attacks.
- Vendor revisedFixed
Microsoft re-released the bulletin (version 2.0) to add updates for Office 2004 and 2008 for Mac, the Open XML File Format Converter for Mac, and Microsoft Works 8.5 and 9, which had not been ready in May.
- Made publicFixed
Microsoft published bulletin MS09-017 with updates for PowerPoint 2000, 2002, 2003 and 2007 and Office 2004 for Mac, covering CVE-2009-0556 among other flaws.
Sources
- Microsoft Security Bulletin MS09-017Microsoft · 12 May 2009
- U.S. CISA adds HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 8 Jan 2026
- CVE-2009-0556: the 2009 PowerPoint bug that refuses to dieLevelBlue SpiderLabs · 23 Jan 2026