CVE-2009-2528: Microsoft .NET Framework

High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days.

GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."

Affected products

• Microsoft .NET Framework: version 1.1 only; version 2.0 only
• Microsoft Excel Viewer: version 2003 only
• Microsoft Expression Web: any version; version 2 only
• Microsoft Forefront Client Security: version 1.0 only
• Microsoft Internet Explorer: version 6 only
• Microsoft Office: version 2003 only; version 2007 only; version xp only
• Microsoft Office Compatibility Pack: version 2007 only
• Microsoft Office Excel Viewer: any version
• Microsoft Office Groove: version 2007 only
• Microsoft Office PowerPoint Viewer: any version; version 2007 only
• Microsoft Office Word Viewer: any version
• Microsoft Platform SDK: any version
• Microsoft Project: version 2002 only
• Microsoft Report Viewer: version 2005 only; version 2008 only
• Microsoft SQL Server: version 2005 only
• Microsoft SQL Server Reporting Services: version 2000 only
• Microsoft Visio: version 2002 only
• Microsoft Visual Foxpro: version 8.0 only; version 9.0 only
• Microsoft Visual Studio: version 2008 only
• Microsoft Visual Studio .net: version 2003 only; version 2005 only
• Microsoft Windows 2003 Server: any version
• Microsoft Windows Server 2008: any version
• Microsoft Windows Vista: any version
• Microsoft Windows XP: any version
• Microsoft Word Viewer: version 2003 only
• and 1 more

Published 2009-10-14. Last modified 2026-06-16.