CVE-2009-3126: Microsoft .NET Framework

High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days.

Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file, aka "GDI+ PNG Integer Overflow Vulnerability."

Affected products

  • Microsoft .NET Framework: version 1.1 only; version 2.0 only
  • Microsoft Excel Viewer: version 2003 only
  • Microsoft Expression Web: any version; version 2 only
  • Microsoft Forefront Client Security: version 1.0 only
  • Microsoft Internet Explorer: version 6 only
  • Microsoft Office: version 2003 only; version 2007 only; version xp only
  • Microsoft Office Compatibility Pack: version 2007 only
  • Microsoft Office Excel Viewer: any version
  • Microsoft Office Groove: version 2007 only
  • Microsoft Office PowerPoint Viewer: any version; version 2007 only
  • Microsoft Office Word Viewer: any version
  • Microsoft Platform SDK: any version
  • Microsoft Project: version 2002 only
  • Microsoft Report Viewer: version 2005 only; version 2008 only
  • Microsoft SQL Server: version 2005 only
  • Microsoft SQL Server Reporting Services: version 2000 only
  • Microsoft Visio: version 2002 only
  • Microsoft Visual Foxpro: version 8.0 only; version 9.0 only
  • Microsoft Visual Studio: version 2008 only
  • Microsoft Visual Studio .net: version 2003 only; version 2005 only
  • Microsoft Windows 2003 Server: any version
  • Microsoft Windows Server 2008: any version
  • Microsoft Windows Vista: any version
  • Microsoft Windows XP: any version
  • Microsoft Word Viewer: version 2003 only
  • and 1 more

Published 2009-10-14. Last modified 2026-06-16.