CVE-2009-0098: Microsoft Exchange Server

High severity, CVSS 9.3. EPSS: 24.9% chance of exploitation in the next 30 days.

Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability."

Affected products

• Microsoft Exchange Server: version 2000 only; version 2003 only; version 2007 only

Published 2009-02-10. Last modified 2026-06-16.