cbcvebase.
CVE-2008-4255
published 2008-12-10

CVE-2008-4255: Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual…

PriorityP268critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
53.70%
98.9th percentile
Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

Affected

8 ranges
VendorProductVersion rangeFixed in
microsoftoffice_frontpage——
microsoftproject——
microsoftproject——
microsoftvisual_basic——
microsoftvisual_foxpro——
microsoftvisual_foxpro——
microsoftvisual_studio_net——
microsoftvisual_studio_net——

Detection & IOCsextracted from sources · hover to see the quote

filenamemscomct2.ocx↗
  • →The malicious AVI file is delivered via a UNC path (SMB share), not HTTP — monitor for ActiveX Animation control loading files from UNC/SMB paths (\\server\share\*.avi). ↗
  • →The exploit triggers a heap-based buffer overflow in mscomct2.ocx via a crafted AVI stream length field. Inspect AVI files for anomalous stream length values that could trigger allocation errors. ↗
  • →The malicious AVI file header begins with the RIFF magic bytes (52 49 46 46) followed by AVI FourCC (41 56 49 20) — a crafted RIFF/AVI with abnormally small or malformed strf/strh chunk sizes should be flagged. ↗
  • ·The PoC uses a placeholder shellcode string rather than real shellcode; real weaponized samples will differ in payload content but the AVI file structure and delivery mechanism remain the same. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.