CVE-2008-4266
Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 27.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel spreadsheet with a NAME record that contains an invalid index value, which triggers stack corruption, aka "Excel Global Array Memory Corruption Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 27.58% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- microsoft/excel · microsoft/excel viewer · microsoft/office · microsoft/open xml file format converter
- Source
- secure@microsoft.com
References
- http://secunia.com/secunia_research/2008-36/Vendor Advisory
- http://www.securityfocus.com/archive/1/499055/100/0/threaded
- http://www.securitytracker.com/id?1021368
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3386Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5808
- http://secunia.com/secunia_research/2008-36/Vendor Advisory
- http://www.securityfocus.com/archive/1/499055/100/0/threaded
- http://www.securitytracker.com/id?1021368
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3386Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5808
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.