CVE-2009-1532

Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via "malformed row property references" that trigger an access of an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Objects Memory Corruption Vulnerability" or "HTML Object Memory Corruption Vulnerability."

• CWE-787
• CWE-787

• http://osvdb.org/54951Broken Link
• http://www.securityfocus.com/archive/1/504208/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022350Broken Link, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlBroken Link, Third Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2009/1538Broken Link, Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-09-041Broken Link, Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6244Broken Link
• http://osvdb.org/54951Broken Link
• http://www.securityfocus.com/archive/1/504208/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022350Broken Link, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlBroken Link, Third Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2009/1538Broken Link, Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-09-041Broken Link, Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6244Broken Link

Published

Jun 10, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1526JBMC Software DirectAdmin before 1.334 allows local users to…
• CVE-2009-1527Race condition in the ptrace_attach function in kernel/ptrac…
• CVE-2009-1528Microsoft Internet Explorer 6 and 7 for Windows XP SP2 and S…
• CVE-2009-1529Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 …8.1
• CVE-2009-1530Use-after-free vulnerability in Microsoft Internet Explorer …
• CVE-2009-1531Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 …
• CVE-2009-1533Buffer overflow in the Works for Windows document converters…
• CVE-2009-1534Buffer overflow in the Office Web Components ActiveX Control…
• CVE-2009-1535The WebDAV extension in Microsoft Internet Information Servi…
• CVE-2009-1536ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 …
• CVE-2009-1537Unspecified vulnerability in the QuickTime Movie Parser Filt…8.8
• CVE-2009-1538The QuickTime Movie Parser Filter in quartz.dll in DirectSho…