Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-1087

CWE-119 — Buffer Overflow5 documents4 sources
Severity
9.3CRITICAL
EPSS
66.6%
top 1.46%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Windows-nt
Timeline
PublishedApr 8
Latest updateMay 1

Description

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h832-fj6x-qx37: Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to e↗2022-05-01
▶
CVEList
CVE-2008-1087: Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to e↗2008-04-08
▶

💥Exploits & PoCs

2
Exploit-DB
Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021)↗2008-10-02
▶
Exploit-DB
Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021)↗2008-04-14
▶
CVE-2008-1087 (CRITICAL CVSS 9.3) | Stack-based buffer overflow in GDI | cvebase.io