$ cve CVE-2008-4255 JSON

CVE-2008-4255 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 53.7% (pctl 99)

Patch early

A public exploit exists.

Description

Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	53.7% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2008-12-10
Last modified	2026-06-16

Affected (5)

Vendor	Product
microsoft	office frontpage
microsoft	project
microsoft	visual basic
microsoft	visual foxpro
microsoft	visual studio .net

Public exploits

Source	Title	Date
exploit-db	Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)	2008-12-12

References

→ the Explorer · watch your stack · NVD