The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1…

Description

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."

Scores

EPSS (exploitation in 30 days)

36.6% · top 1.5% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• n/a
• CWE-457 Use of Uninitialized Variable (opens in a new tab)All about CWE-457 and its CVEs
• CWE-94 (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• n/a

  • affected n/a

References (25)

• http://www.adobe.com/support/security/bulletins/apsb09-11.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 266108 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• 35832 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• ADV-2009-2034 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• TA09-223A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• http://www.adobe.com/support/security/bulletins/apsb09-13.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1 (opens in a new tab)x_refsource_CONFIRMx_transferred
• TA09-286A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• MS09-035 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
• http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx (opens in a new tab)x_refsource_MISCx_transferred
• oval:org.mitre.oval:def:7581 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• oval:org.mitre.oval:def:6289 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• SSRT100013 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• 36187 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:6311 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• ADV-2009-2232 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://www.adobe.com/support/security/bulletins/apsb09-10.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 36374 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MS09-037 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred
• http://www.adobe.com/support/security/advisories/apsa09-04.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 36746 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:6373 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 35967 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• TA09-195A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• MS09-060 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-0901](https://trackcve.app/badge/CVE-2009-0901.svg)](https://trackcve.app/cve/CVE-2009-0901)

Record last updated 27 May 2026, 15:34 UTC.