CVE-2008-3013

published 2008-09-11

CVE-2008-3013: gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3…

Priority P2 68 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a malformed GIF image file containing many extension markers for graphic control extensions and subsequent unknown labels, aka "GDI+ GIF Parsing Vulnerability."

Affected

13 ranges

Vendor	Product	Version range	Fixed in
microsoft	digital_image_suite	—	—
microsoft	forefront_client_security	—	—
microsoft	internet_explorer	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	powerpoint_viewer	—	—
microsoft	report_viewer	—	—
microsoft	report_viewer	—	—
microsoft	sql_server	—	—
microsoft	sql_server_reporting_services	—	—
microsoft	visio	—	—
microsoft	works	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename gdiplus.dll↗

bytes↗

21 EC (repeated extension introducer + unknown label pattern triggering GDI+ GIF parsing vulnerability)

• → Trigger condition: malformed GIF file containing many extension markers (0x21) for graphic control extensions followed by subsequent unknown labels (e.g., 0xEC, 0x2C interleaved). Detect GIF files with abnormally high counts of 0x21 extension introducer bytes in the data stream. ↗
• → The PoC GIF begins with the standard GIF89a magic bytes (47 49 46 38 39 61) followed by a Logical Screen Descriptor with flags 0xF7 0x0B 0x0B, then a large color table of 0x33 bytes, then repeated 0x21 0xEC sequences. Inspect GIF files for this pattern of repeated extension+unknown-label pairs. ↗
• → The vulnerable component is gdiplus.dll version 5.1.3102.2180. Monitor for this specific DLL version loaded in browser or Office processes when processing GIF content. ↗

• · This is a PoC (proof-of-concept) exploit demonstrating a crash/DoS condition, not a fully weaponized exploit with shellcode. The byte sequences provided represent the malformed GIF structure used to trigger the parsing bug, not a complete RCE payload. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-399