CVE-2009-0556: CISA Flags Legacy PowerPoint Vulnerability Due to Ongoing Exploitation Risk

CVE Name: Microsoft Office PowerPoint OutlineTextRefAtom Code Injection
CVE ID: CVE-2009-0556
Affected Product: Microsoft Office PowerPoint
Vulnerability Type: Code Injection caused by memory corruption
CWE Mapping: CWE-94 – Improper Control of Code Generation
CVSS v2 Base Score: 9.3
Severity: Critical
Attack Vector: Remote
Privileges Required: None
User Interaction Required: Yes. The user must open a malicious PowerPoint file.
Exploitability: High on unpatched systems
Exploit Availability: Public exploit code was available historically
Known Ransomware Use: Unknown. No direct ransomware attribution has been documented.
CISA KEV Catalog Status: Not listed (the vulnerability predates the KEV program)
CISA KEV Date: Not applicable

Technical Description

CVE-2009-0556 affects the way Microsoft PowerPoint handles certain internal references while opening a presentation. The issue sits in PowerPoint’s processing of a structure known as OutlineTextRefAtom, which is used to map text elements to the outline view of a slide deck.

PowerPoint assumes that index values inside this structure are valid. When a crafted file supplies an index that falls outside the expected range, PowerPoint does not properly verify it before using the value. As a result, the application may attempt to access memory locations that were never intended to be referenced.

This leads to heap memory corruption. With careful manipulation of the file layout, an attacker can influence how memory is overwritten and redirect execution to attacker-controlled code. The flaw is triggered early during file parsing, before PowerPoint has a chance to safely reject malformed content.

How the Vulnerability Can Be Exploited

In practical terms, exploitation follows a fairly typical document-based attack pattern:

The attacker creates a malicious .ppt file.
The file contains a malformed OutlineTextRefAtom record with an invalid index value.
Memory layout is influenced using heap spraying so the corrupted reference lands in predictable locations.
Shellcode is placed in memory areas likely to be executed after corruption occurs.
The file is delivered to the victim, most commonly through phishing email or file sharing.
Once the victim opens the file, PowerPoint processes the malicious structure and corrupts memory.
Execution flow is redirected, and the payload runs under the user’s context.

There is no visible warning to the user before exploitation occurs.

Impact

If exploited successfully, this vulnerability allows an attacker to run arbitrary code as the user who opened the file. From there, the attacker can:

Install malware or backdoors
Access or modify local files
Capture credentials or sensitive data
Establish persistence on the system
Use the compromised host to move laterally within a network

Systems where users have administrative rights are especially exposed, as exploitation may lead to full system compromise.

MITRE ATT&CK Mapping

Initial Access

T1566.001 – Phishing: Attachment

Execution

T1203 – Exploitation for Client Execution

Persistence

T1547 – Boot or Logon Autostart Execution

Privilege Escalation (Environment Dependent)

T1068 – Exploitation for Privilege Escalation

Proof of Concept (PoC) Status

Public proof-of-concept exploits were available around the time this vulnerability was disclosed. These demonstrations showed:

Consistent application crashes on vulnerable systems
Control over instruction pointers
Successful execution of arbitrary shellcode

At the time, exploitation was considered reliable against unpatched versions of PowerPoint.

Payload Details

Payloads associated with this vulnerability typically consisted of:

In-memory Windows shellcode
Reverse shells or small downloader stagers
Large heap spray blocks to stabilize exploitation
NOP sleds to account for memory layout variation

Once triggered, payload execution happens immediately after the file is opened.

Detection Opportunities

Host-Based Detection

Indicators on the endpoint may include:

PowerPoint crashing unexpectedly
POWERPNT.EXE spawning child processes such as cmd.exe or powershell.exe
Executables appearing in temporary or user profile directories
Memory access violations followed by abnormal process behavior

Network-Based Detection

From a network perspective, suspicious signs may include:

Outbound connections initiated directly by PowerPoint
Traffic to unfamiliar or low-reputation IP addresses
Network activity occurring immediately after a presentation is opened

File-Based Detection

Malicious files may exhibit:

Abnormal or malformed OutlineTextRefAtom records
Invalid index references within the file structure
Unusual object sizes or offsets inconsistent with normal presentations

Detection Rules

Endpoint Detection Logic

Alerting should be considered when:

POWERPNT.EXE launches command shells or scripting engines
PowerPoint allocates executable memory at runtime
Shellcode-like byte patterns appear in heap memory

Network Detection Logic

Network alerts may trigger on:

PowerPoint-initiated outbound traffic
DNS lookups to newly registered domains
Repeating beacon-style communication after file execution

Recommended Log Sources

For investigation and monitoring, the following log sources are useful:

Endpoint Logs
- Windows Application and Security logs
- EDR telemetry covering process creation and memory activity
Email Security Logs
- Attachment scanning and sandbox verdicts
- File hash and reputation data
Network Logs
- Firewall and proxy logs
- Secure web gateway logs
- IDS or IPS alerts

Mitigation and Remediation

Immediate Actions

Apply Microsoft’s security update addressing CVE-2009-0556.
Restrict or block legacy .ppt files where possible.
Disable automatic preview of PowerPoint attachments in email clients.

Defensive Controls

Enforce least-privilege access for users
Use endpoint protection capable of detecting memory exploitation
Deploy email filtering and attachment sandboxing

Long-Term Recommendation

Remove unsupported Office versions from the environment
Migrate users to supported, regularly patched Office releases
Periodically audit systems for legacy software usage

Official Patch Information

Vendor: Microsoft
Security Bulletin: MS09-017
Associated KB Article: KB969615
Official Patch Link:
https://support.microsoft.com/help/969615
Patch Availability: Microsoft Update, Windows Update, Microsoft Download Center

This update corrects the way PowerPoint validates internal object references and prevents invalid index values from causing memory corruption.

Final Takeaway

CVE-2009-0556 is a serious client-side vulnerability that allows code execution through a malicious PowerPoint file. While it is an older issue, it still poses a real risk in environments that rely on outdated or unsupported Office installations.

Any organization still running vulnerable versions of PowerPoint should consider this issue critical and ensure systems are patched or retired as soon as possible.