CVE-2008-2245

published 2008-08-13

CVE-2008-2245: Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS) in the Image Color…

Priority P2 64 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS) in the Image Color Management (ICM) component on Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted image file.

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6732.rar↗

filename 2008-emf_MS08-046.rar↗

version mscms.dll 5.1.2600.2709↗

• → Vulnerability is triggered via a crafted image file targeting the InternalOpenColorProfile function in mscms.dll; inspect image files processed by MSCMS/ICM for anomalous ICC profile data. ↗
• → The exploit abuses the EMR_SETICMPROFILEA record in EMF files to trigger the heap overflow; monitor for malformed EMF files containing oversized or malformed EMR_SETICMPROFILEA records. ↗
• → Exploitation causes Windows Explorer and Internet Explorer to crash; unexpected crashes of explorer.exe or iexplore.exe may indicate exploitation attempts. ↗

• · PoC was tested specifically against Windows XP Professional SP2 with the listed mscms.dll and gdi32.dll versions; exploit reliability against other affected platforms (Windows 2000 SP4, XP SP3, Server 2003 SP1/SP2) may vary. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119