CVE-2009-2140: Go-Oo

High severity, CVSS 9.3. EPSS: 5.7% chance of exploitation in the next 30 days.

Multiple heap-based buffer overflows in cppcanvas/source/mtfrenderer/emfplus.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allow remote attackers to execute arbitrary code via a crafted EMF+ file, a similar issue to CVE-2008-2238.

Affected products

• Go-Oo Go-Oo: version 2.3.0 only; version 2.4.0 only; version 2.4.1 only; version 3.0 only

Published 2009-09-21. Last modified 2026-06-16.