CVE-2009-2494

The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via vectors related to erroneous free operations after reading a variant from a stream and deleting this variant, aka "ATL Object Type Mismatch Vulnerability."

• CWE-94
• CWE-94

• http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
• http://osvdb.org/56910
• http://secunia.com/advisories/36187Vendor Advisory
• http://www.securityfocus.com/bid/35982Patch
• http://www.securitytracker.com/id?1022712
• http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2232Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5708
• http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
• http://osvdb.org/56910
• http://secunia.com/advisories/36187Vendor Advisory
• http://www.securityfocus.com/bid/35982Patch
• http://www.securitytracker.com/id?1022712
• http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2232Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5708

Published

Aug 12, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2488Unspecified vulnerability in the NFSv4 module in the kernel …
• CVE-2009-2489Unspecified vulnerability in the utdmsession program in Sun …
• CVE-2009-2490Unspecified vulnerability in the utaudiod daemon in Sun Ray …
• CVE-2009-2491The utaudiod daemon in Sun Ray Server Software (SRSS) 4.0, w…
• CVE-2009-2492Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in…
• CVE-2009-2493The Active Template Library (ATL) in Microsoft Visual Studio…8.8
• CVE-2009-2495The Active Template Library (ATL) in Microsoft Visual Studio…6.5
• CVE-2009-2496Heap-based buffer overflow in the Office Web Components Acti…
• CVE-2009-2497The Common Language Runtime (CLR) in Microsoft .NET Framewor…
• CVE-2009-2498Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and …
• CVE-2009-2499Microsoft Windows Media Format Runtime 9.0, 9.5, and 11; and…
• CVE-2009-2500Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP…