Vulnerability record

CVE-2009-3129

Microsoft Excel Featheader Record Memory Corruption Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Excel, fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Mar 24, 2022.

Patch status

Official fix available since Sep 30, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Patch or advisory on docs.microsoft.com (opens in a new tab)

Description

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Excel	Microsoft	2002; 2003; 2007	KEV
Office	Microsoft	2004; 2008	NVD

Sources: KEV = CISA Known Exploited Vulnerabilities catalog; NVD = NIST National Vulnerability Database.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2009-3129 scored CVSS 7.8: Microsoft Excel, Microsoft Excel Featheader Record Memory Corruption Vulnerability
CISA lists this as exploited in the wild. Unpatched Excel systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
Patch releasedUpdateKEVSep 30, 2026
Patch released for CVE-2009-3129: Microsoft Excel, Microsoft Excel Featheader Record Memory Corruption Vulnerability
An official fix is now available for Microsoft Excel. This vulnerability is being exploited, so apply it promptly.
Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2009-3129
archives.neohapsis.com http://archives.neohapsis.com/archives/bugtraq/2009-11/0080.html
labs.idefense.com http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=832
osvdb.org http://osvdb.org/59860
exploit-db.com http://www.exploit-db.com/exploits/14706
securityfocus.com http://www.securityfocus.com/bid/36945
securitytracker.com http://www.securitytracker.com/id?1023157
us-cert.gov http://www.us-cert.gov/cas/techalerts/TA09-314A.html
zerodayinitiative.com http://www.zerodayinitiative.com/advisories/ZDI-09-083
docs.microsoft.com https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067
oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6521
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3129