U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2009-0556 Microsoft Office PowerPoint Code Injection Vulnerability
- CVE-2025-37164 HPE OneView Code Injection Vulnerability
CVE-2009-0556 is a memory corruption flaw in legacy Microsoft PowerPoint that allows attackers to execute arbitrary code via a crafted .ppt file. An invalid index in the OutlineTextRefAtom triggers improper memory handling when the file is opened. Exploited in the wild in April 2009 (Exploit:Win32/Apptom.gen), it affects PowerPoint 2000/2002/2003 and Office 2004 for Mac, enabling full compromise with user privileges.
“Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka “Memory Corruption Vulnerability.”” reads the advisory.
In December, Hewlett Packard Enterprise (HPE) addressed a maximum-severity security vulnerability, tracked as CVE-2025-37164 (CVSS score of 10.0), in OneView Software. An attacker can exploit the flaw to achieve remote code execution.
HPE OneView is an integrated IT management and automation platform by Hewlett Packard Enterprise used to manage, monitor, and automate HPE data center infrastructure.
It provides a single, software-defined interface to control servers, storage, and networking, mainly in HPE environments (e.g., ProLiant servers and Synergy systems).
“A potential security vulnerability has been identified in Hewlett Packard Enterprise OneView Software. This vulnerability could be exploited, allowing a remote unauthenticated user to perform remote code execution.” reads the advisory published by the company.
The flaw impacts all versions through v10.20.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by January 28, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
