CVE-2008-4844
EXPLOITED IN THE WILDMicrosoft Internet Explorer - Resource Management Error
Title source: ruleDescription
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular Data Control (TDC) in a crafted HTML or XML document, as demonstrated by nested SPAN or MARQUEE elements, and exploited in the wild in December 2008.
Exploits (6)
metasploit
WORKING POC
NORMAL
by hdm · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms08_078_xml_corruption.rb
exploitdb
WORKING POC
VERIFIED
by Jeremy Brown · perlremotewindows
https://www.exploit-db.com/exploits/7583
exploitdb
WORKING POC
VERIFIED
by krafty · htmlremotewindows
https://www.exploit-db.com/exploits/7477
exploitdb
WORKING POC
VERIFIED
by Guido Landi · textremotewindows
https://www.exploit-db.com/exploits/7403
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16583
References (21)
... and 1 more
Scores
EPSS
0.8285
EPSS Percentile
99.2%
Exploitation Intel
VulnCheck KEV
2008-12-11
InTheWild.io
2018-10-12
Classification
CWE
CWE-399
Status
draft
Affected Products (4)
microsoft/internet_explorer
microsoft/internet_explorer
microsoft/internet_explorer
microsoft/internet_explorer
Timeline
Published
Dec 11, 2008
Tracked Since
Feb 18, 2026