CASCACascade Atlas

Evidence dossier

CVE-2009-0563

Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2;

Exploited in the wild (CISA KEV since Jun 8, 2022). NVD reports CVSS 3.1 7.8. EPSS estimates 63.1% exploit likelihood as of Aug 27, 2026.

80.0–81.1Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."

State
PUBLISHED
Published
Jun 10, 2009
Updated
Oct 22, 2025
Evidence coverage
98%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    microsoft

    Record text: Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."

    Inspect raw assertion
    Field
    container
    Value
    Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Microsoft Office Buffer Overflow Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Microsoft Office Buffer Overflow Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 63.08% probability · 99.14th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.630810000000; percentile 0.991390000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Jun 8, 2022 · first observed Jul 19, 2026

Exploit likelihood63.08%

FIRST EPSS · score date Aug 27, 2026 · 99.1th percentile · first observed Aug 27, 2026

SeverityCVSS 7.8

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
microsoftOriginal assertion
Record text

Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."

Inspect raw assertion
Field
container
Value
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Microsoft Office Buffer Overflow Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Microsoft Office Buffer Overflow Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

63.08% probability · 99.14th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.630810000000; percentile 0.991390000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
12Underlying assertions
4Canonical products
12Target assertions
0Constraint assertions

Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

5 scope groups

microsoft · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "n/a"}]
NVD CPE · APPLICATIONmicrosoftofficeVulnerable target · 7 assertions
Version 2000; Version 2003; Version 2004; Version 2007; Version 2008; Version xpCanonical identity product-f4efee17050cd92d62299077c43827052b373ddcb783c02caa43c2fbb378d2f4Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a332d04d-cc8c-4f68-a261-ba2f2d8ead1e
  2. cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4891122f-ad7f-45e6-98c6-833227916f6b
  3. cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    79ba1175-7f02-4435-aea6-1ba8aadeb7ef
  4. cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    421acf1b-1b21-4416-98ed-baa5c210eae5
  5. cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0b191155-67f2-4c6e-bd0c-af5af6f04ba1
  6. cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    08af794a-435d-4171-9dbb-eb7faed96dba
  7. cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    69e6b9eb-d3f7-4c57-bf2f-61664e5c2c7d
NVD CPE · APPLICATIONmicrosoftoffice_compatibility_packVulnerable target · 2 assertions
Version 2007Canonical identity product-fe758137686484ffb07abeab90c90f69f48242b9bb56d3d0eb99f12d1ca3aa5dLinked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a4b44889-aeeb-4713-a047-c27b802db257
  2. cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c5c94f2c-786b-45e4-b80a-fc668d917014
NVD CPE · APPLICATIONmicrosoftoffice_word_viewerVulnerable target · 2 assertions
Version 2003; Version not applicableCanonical identity product-d4961dfd8a4399733262c3c8374d834756c5c17f84bd52de66db3993629d4b40Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:microsoft:office_word_viewer:2003:sp3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b4b148cc-6c58-411b-8503-01f3be1d5906
  2. cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c64b2636-8f96-48ba-921f-a8fa0e62de63
NVD CPE · APPLICATIONmicrosoftopen_xml_file_format_converterVulnerable target · 1 assertions
Version not applicableCanonical identity product-71a95a06144a68939957ed8acd21099e5d8f2038d269cab72fc65f0d7acb44f2Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4bc69733-551e-4535-b851-4a3ef71e98cd

Affected-product evidence

Accepted scope and product mapping

4 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-01299a5a765aea70faa05f2d06e0c26a5d498fd34553e868d89e8a43b31864db · product-71a95a06144a68939957ed8acd21099e5d8f2038d269cab72fc65f0d7acb44f2

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
3aced802-9083-4e88-a213-79fee50ba9fc
Mapping establishedEvidence supported

vendor-01299a5a765aea70faa05f2d06e0c26a5d498fd34553e868d89e8a43b31864db · product-d4961dfd8a4399733262c3c8374d834756c5c17f84bd52de66db3993629d4b40

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
3f74d314-931b-4e33-8281-bffd6d141e0dfc844f5b-a2c3-4ea5-b574-962777ebba50
Mapping establishedEvidence supported

vendor-01299a5a765aea70faa05f2d06e0c26a5d498fd34553e868d89e8a43b31864db · product-f4efee17050cd92d62299077c43827052b373ddcb783c02caa43c2fbb378d2f4

Source class
Nvd cpe vulnerable target
Assertions
7
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
11696b1c-5638-401c-a381-1857b37a376e2d8f9a4d-a197-49a7-9df2-beba9cc6291b444d0e05-545e-4d06-b269-df518922701c6ef33be6-c63f-4ec1-8500-e669e0c042f1acbf3343-47d7-407b-beee-70120cbcb265bde13027-314c-42e9-b767-4f7102dddf0ef4f5fb9a-5d6c-423f-896d-873931207da1
Mapping establishedEvidence supported

vendor-01299a5a765aea70faa05f2d06e0c26a5d498fd34553e868d89e8a43b31864db · product-fe758137686484ffb07abeab90c90f69f48242b9bb56d3d0eb99f12d1ca3aa5d

Source class
Nvd cpe vulnerable target
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
0b137732-3092-4629-b56e-66b437dafe29af860710-ccc7-4a5e-8f9c-3a27e15e271a
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
c4639d81-f2dd-414a-bf8e-f82669a4d837

Assessments

CVSS by origin

7.8
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:M/Au:N/C:C/I:C/A:C
7.8
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

7.8Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
7.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.