CISA Warns of Microsoft PowerPoint Code Injection Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a code-injection vulnerability in Microsoft PowerPoint, warning of a significant risk to organizations worldwide.

The vulnerability, tracked as CVE-2009-0556, allows remote attackers to execute arbitrary code by crafting malicious PowerPoint files. Potentially compromising system security and enabling unauthorized access to sensitive data.

The flaw lies in Microsoft PowerPoint’s handling of OutlineTextRefAtom objects. When a PowerPoint file contains an OutlineTextRefAtom with an invalid index value.

It triggers memory corruption that attackers can exploit to inject and execute arbitrary code on affected systems.

This weakness is classified as CWE-94 (Improper Control of Generation of Code), a critical category that covers code injection vulnerabilities.

<h2 class="wp-block-heading" id="h-Microsoft PowerPoint Code-injection-vulnerability”>Microsoft PowerPoint Code Injection Vulnerability

This allows attackers to alter program execution by injecting malicious instructions through legitimate data channels.

The vulnerability requires minimal user interaction; victims need only open a specially crafted PowerPoint presentation. Once executed, attackers can run arbitrary code with the affected user’s privileges.

This potentially leads to complete system compromise, data theft, and lateral movement within organizational networks.

The simplicity of the attack vector, combined with the severity of the potential impact, makes this a high-priority threat.

CISA added CVE-2009-0556 to its Known Exploited Vulnerabilities Catalog on January 7, 2026, with a deadline of January 28, 2026, for organizations to apply necessary protections.

The agency recommends three critical actions: apply vendor-supplied mitigations immediately, adhere to BOD 22-01 guidance for cloud-based services. Discontinue use of vulnerable PowerPoint versions entirely if patches are unavailable.

Organizations should prioritize the immediate deployment of Microsoft’s security patches across all systems running affected versions of PowerPoint.

Email security controls should be strengthened to filter suspicious PowerPoint attachments, and user awareness training should emphasize the risks of opening unexpected presentations from untrusted sources.

Security teams must also conduct vulnerability assessments to identify and remediate exposed systems before the CISA deadline.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.