CVE-2009-0566: Microsoft Office Publisher

High severity, CVSS 9.3. EPSS: 28.9% chance of exploitation in the next 30 days.

Microsoft Office Publisher 2007 SP1 does not properly calculate object handler data for Publisher files, which allows remote attackers to execute arbitrary code via a crafted file in a legacy format that triggers memory corruption, aka "Pointer Dereference Vulnerability."

Affected products

• Microsoft Office Publisher: version 2007 only

Published 2009-07-15. Last modified 2026-06-16.