CVE-2008-3015: Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2…

PriorityP260critical9.3CVSS 2.0

AVNACMAuNCCICAC

EPSS

39.27%

98.4th percentile

Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a BMP image file with a malformed BitMapInfoHeader that triggers a buffer overflow, aka "GDI+ BMP Integer Overflow Vulnerability."

Affected

12 ranges

Vendor	Product	Version range	Fixed in
microsoft	digital_image_suite	—	—
microsoft	forefront_client_security	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	office	—	—
microsoft	office_powerpoint_viewer	—	—
microsoft	report_viewer	—	—
microsoft	report_viewer	—	—
microsoft	sql_server	—	—
microsoft	sql_server_reporting_services	—	—
microsoft	visio	—	—
microsoft	works	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.