{"id":"CVE-2008-0015","url":"https://www.cyber-defence.io/tools/cve/CVE-2008-0015","generatedAt":"2026-10-31T23:40:29.125Z","title":" Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability","description":"Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka \"Microsoft Video ActiveX Control Vulnerability.\"","published":"2009-07-07T23:30:00.000Z","lastModified":"2026-06-16T22:48:46.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-119","CWE-121"],"affected":["microsoft/windows 2003 server","microsoft/windows xp"],"epss":{"score":0.76576,"percentile":0.99542,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2026-02-17","dueDate":"2026-03-10","knownRansomwareCampaignUse":"Unknown","notes":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\nhttps://web.archive.org/web/20110305211119/https://www.microsoft.com/technet/security/bulletin/ms09-032.mspx ; https://nvd.nist.gov/vuln/detail/CVE-2008-0015"},"exploits":{"count":2,"verified":true,"firstPublished":"2009-07-10","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":16615,"kind":"exploit","title":"Microsoft DirectShow - 'msvidctl.dll' MPEG-2 Memory Corruption (MS09-032/MS09-037) (Metasploit)","url":"https://www.exploit-db.com/exploits/16615","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/16615.rb","file":"exploits/windows/local/16615.rb","published":"2010-04-30","added":"2010-04-30","updated":"2011-03-10","author":"Metasploit","type":"local","platform":"windows","port":null,"verified":true,"codes":["CVE-2008-0015","OSVDB-55651","MS09-032","MS09-037"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"http://www.microsoft.com/technet/security/advisory/972890.mspx"},{"edbId":9108,"kind":"exploit","title":"Microsoft Internet Explorer 7 Video - ActiveX Remote Buffer Overflow","url":"https://www.exploit-db.com/exploits/9108","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/9108.py","file":"exploits/windows/remote/9108.py","published":"2009-07-10","added":"2009-07-09","updated":null,"author":"David Kennedy (ReL1K)","type":"remote","platform":"windows","port":null,"verified":true,"codes":["CVE-2008-0015","OSVDB-55651"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 10 March 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://isc.sans.org/diary.html?storyid=6733","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://osvdb.org/55651","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/36187","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://www.iss.net/threats/329.html","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://www.kb.cert.org/vuls/id/180513","tags":["US Government Resource"],"source":"cve@mitre.org"},{"url":"http://www.microsoft.com/technet/security/advisory/972890.mspx","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/35558","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/35585","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id?1022514","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-187A.html","tags":["US Government Resource"],"source":"cve@mitre.org"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-195A.html","tags":["US Government Resource"],"source":"cve@mitre.org"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-223A.html","tags":["US Government Resource"],"source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2009/2232","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://isc.sans.org/diary.html?storyid=6733","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://osvdb.org/55651","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/36187","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.iss.net/threats/329.html","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.kb.cert.org/vuls/id/180513","tags":["US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.microsoft.com/technet/security/advisory/972890.mspx","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/35558","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/35585","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id?1022514","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-187A.html","tags":["US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-195A.html","tags":["US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-223A.html","tags":["US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2009/2232","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-0015","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0015","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}