Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

IE, Windows XP, Office can run code from malicious WMF

CVE-2009-2500 · published 17 years ago
Summary

Several Microsoft products—including Internet Explorer 6, Windows XP, and many Office applications—have a flaw that can be triggered by a specially crafted WMF picture file. An attacker who tricks a user into opening such a file could cause the software to execute any code the attacker chooses, potentially taking control of the computer. Apply the latest security updates from Microsoft or use a supported, patched version of these products to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_2003_server All versions
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
microsoft windows_server_2008 All versions
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
microsoft windows_vista All versions
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
microsoft windows_xp All versions
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoft .net_framework 1.1
2.0
cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
microsoft internet_explorer 6
cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
microsoft report_viewer 2005
2008
cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:*
microsoft sql_server 2005
cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:*
microsoft sql_server_reporting_services 2000
cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:*
microsoft excel_viewer 2003
cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*
microsoft expression_web 2
cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:*
microsoft office 2003
2007
xp
cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
microsoft office_compatibility_pack 2007
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
microsoft office_excel_viewer All versions
cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
microsoft office_groove 2007
cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:*
microsoft office_powerpoint_viewer 2007
cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:*
microsoft office_word_viewer All versions
cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:*
microsoft project 2002
cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:*
microsoft visio 2002
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*
microsoft word_viewer 2003
cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*
microsoft works 8.5
cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:*
microsoft platform_sdk All versions
cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:*
microsoft visual_studio 2008
cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:*
microsoft visual_studio_.net 2003
2005
cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*
microsoft forefront_client_security 1.0
cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:*
microsoft visual_foxpro 8.0
9.0
cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
Original advisory text
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 ...
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted WMF image file, aka "GDI+ WMF Integer Overflow Vulnerability."
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
24% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published14 Oct 2009
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2009-2500 · NVD
Track software like this
Free during beta