$ cve CVE-2008-4453 JSON

CVE-2008-4453 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 10.5% (pctl 96)

Patch early

A public exploit exists.

Description

The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) 5.7.0.1 allows remote attackers to create, overwrite, and modify arbitrary files via the SaveAsPDF method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	10.47% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-264
On CISA KEV	no
Public exploit	yes
Published	2008-10-06
Last modified	2026-06-16

Affected (2)

Vendor	Product
dspicture	light imaging toolkit
dspicture	pro imaging sdk

Public exploits

Source	Title	Date
exploit-db	GdPicture Pro - ActiveX 'gdpicture4s.ocx' File Overwrite / Exec	2008-09-30

References

→ the Explorer · watch your stack · NVD