CVE-2009-0102: Microsoft Office Project

High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days.

Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Project Memory Validation Vulnerability."

Affected products

• Microsoft Office Project: version 2007 only
• Microsoft Project Portfolio Server: version 2007 only
• Microsoft Project Server: version 2003 only; version 2007 only

Published 2009-12-09. Last modified 2026-06-16.