CVE-2008-2249

EXPLOITED

Microsoft Windows GDI - Remote Code Execution via Malformed WMF Header

Title source: llm

Exploitation Summary

CVE-2008-2249 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a malformed header in a crafted WMF file, which triggers a buffer overflow, aka "GDI Integer Overflow Vulnerability."

References (6)

Core 6

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/3383

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-071

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5984

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1021365

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA08-344A.html

Third Party Advisory third-party-advisory x_refsource_idefense

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=762

Scores

EPSS 0.3112

EPSS Percentile 98.1%

Details

VulnCheck KEV 2012-10-18

CWE

CWE-189

Status published

Products (7)

microsoft/windows_2000

microsoft/windows_2003_server (3 CPE variants)

microsoft/windows_server_2003 (3 CPE variants)

microsoft/windows_server_2008 (3 CPE variants)

microsoft/windows_vista (2 CPE variants)

microsoft/windows_vista gold

microsoft/windows_xp (4 CPE variants)

Published Dec 10, 2008

Tracked Since Feb 18, 2026