CVE-2009-2518: Microsoft Office

High severity, CVSS 9.3. EPSS: 22.6% chance of exploitation in the next 30 days.

Integer overflow in GDI+ in Microsoft Office XP SP3 allows remote attackers to execute arbitrary code via an Office document with a bitmap (aka BMP) image that triggers memory corruption, aka "Office BMP Integer Overflow Vulnerability."

Affected products

• Microsoft Office: version xp only

Published 2009-10-14. Last modified 2026-06-16.