CVE-2008-0082

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 34.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-08-13 · updated 2026-06-16
Weakness: CWE-200

Description

An ActiveX control (Messenger.UIAutomation.1) in Windows Messenger 4.7 and 5.1 is marked as safe-for-scripting, which allows remote attackers to control the Messenger application, and "change state," obtain contact information, and establish audio or video connections without notification via unknown vectors.

Affected products

Microsoft Windows Messenger: 4.7, 5.1

References

http://marc.info/?l=bugtraq&m=121915960406986&w=2
http://secunia.com/advisories/31446
http://www.securityfocus.com/archive/1/495467/100/0/threaded
http://www.securityfocus.com/bid/30551
http://www.securitytracker.com/id?1020681
http://www.us-cert.gov/cas/techalerts/TA08-225A.html
http://www.vupen.com/english/advisories/2008/2354
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-050
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5995
http://marc.info/?l=bugtraq&m=121915960406986&w=2
http://secunia.com/advisories/31446
http://www.securityfocus.com/archive/1/495467/100/0/threaded

Get alerted when CVE-2008-0082 or the next vulnerability affects your stack