$ cve CVE-2008-2463 JSON

CVE-2008-2463 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 59.1% (pctl 99)

Patch early

A public exploit exists.

Description

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	59.13% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2008-07-07
Last modified	2026-06-16

Affected (1)

Vendor	Product
microsoft	office snapshot viewer activex

Public exploits

Source	Title	Date
exploit-db	Snapshot Viewer for Microsoft Access - ActiveX Control Arbitrary File Download (Metasploit)	2010-09-20
exploit-db	Microsoft Access - 'Snapview.ocx 10.0.5529.0' ActiveX Remote File Download	2008-07-24

References

→ the Explorer · watch your stack · NVD