CVE-2008-0015

8.8 HIGH CISA KEV - Actively Exploited
Published: July 07, 2009 Modified: February 18, 2026
View on NVD

Description

Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
Source: cve@mitre.org
http://isc.sans.org/diary.html?storyid=6733
Source: cve@mitre.org
Exploit
http://osvdb.org/55651
Source: cve@mitre.org
http://secunia.com/advisories/36187
Source: cve@mitre.org
http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799
Source: cve@mitre.org
Exploit
http://www.iss.net/threats/329.html
Source: cve@mitre.org
Exploit
http://www.kb.cert.org/vuls/id/180513
Source: cve@mitre.org
US Government Resource
http://www.microsoft.com/technet/security/advisory/972890.mspx
Source: cve@mitre.org
Vendor Advisory
http://www.securityfocus.com/bid/35558
Source: cve@mitre.org
http://www.securityfocus.com/bid/35585
Source: cve@mitre.org
http://www.securitytracker.com/id?1022514
Source: cve@mitre.org
http://www.us-cert.gov/cas/techalerts/TA09-187A.html
Source: cve@mitre.org
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-195A.html
Source: cve@mitre.org
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
Source: cve@mitre.org
US Government Resource
http://www.vupen.com/english/advisories/2009/2232
Source: cve@mitre.org
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032
Source: cve@mitre.org
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
Source: cve@mitre.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333
Source: cve@mitre.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363
Source: cve@mitre.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436
Source: cve@mitre.org
http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
Source: af854a3a-2127-422b-91ae-364da2661108
http://isc.sans.org/diary.html?storyid=6733
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://osvdb.org/55651
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/36187
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.iss.net/threats/329.html
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.kb.cert.org/vuls/id/180513
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
http://www.microsoft.com/technet/security/advisory/972890.mspx
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.securityfocus.com/bid/35558
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/35585
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securitytracker.com/id?1022514
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.us-cert.gov/cas/techalerts/TA09-187A.html
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-195A.html
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
http://www.vupen.com/english/advisories/2009/2232
Source: af854a3a-2127-422b-91ae-364da2661108
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032
Source: af854a3a-2127-422b-91ae-364da2661108
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
Source: af854a3a-2127-422b-91ae-364da2661108
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333
Source: af854a3a-2127-422b-91ae-364da2661108
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363
Source: af854a3a-2127-422b-91ae-364da2661108
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436
Source: af854a3a-2127-422b-91ae-364da2661108
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-0015
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

41 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.8 / 10.0
EPSS (Exploit Probability)
80.6%
99th percentile
Exploitation Status
Actively Exploited
Remediation due: 2026-03-10

Weaknesses (CWE)

CWE-119 CWE-121

Affected Vendors

microsoft

Related CVEs

CVE-2026-4472 6.3
CVE-2026-4471 4.7
CVE-2026-4470 4.7
CVE-2026-4469 4.7
CVE-2026-33035 N/A