Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-0116 — Improper Input Validation in Microsoft Excel

CWE-20 — Improper Input ValidationCWE-94 — Code Injection4 documents4 sources
Severity
9.3CRITICALNVD
EPSS
74.4%
top 1.15%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Microsoft ExcelMicrosoft Excel ViewerMicrosoft Office
Timeline
PublishedMar 11
Latest updateMay 1

Description

Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDmicrosoft/excel2000, 2002, 2003+2
▶NVDmicrosoft/office2004, 2008+1

Patches

Patch: www.securityfocus.com ↗Patch: www.us-cert.gov ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9w5m-5829-xj6c: Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to↗2022-05-01
▶
CVEList
CVE-2008-0116: Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to↗2008-03-11
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Excel - Code Execution (MS08-014)↗2008-03-21
▶
CVE-2008-0116 — Improper Input Validation in Microsoft | cvebase