CVE-2008-0109

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 30.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-02-12 · updated 2026-06-16
Weakness: CWE-399

Description

Word in Microsoft Office 2000 SP3, XP SP3, Office 2003 SP2, and Office Word Viewer 2003 allows remote attackers to execute arbitrary code via crafted fields within the File Information Block (FIB) of a Word file, which triggers length calculation errors and memory corruption.

Affected products

Microsoft Office: 2000-sp3, 2003, 2003-sp2, xp-sp3
Microsoft Word for Android: all versions

References

http://marc.info/?l=bugtraq&m=120361015026386&w=2
http://secunia.com/advisories/28901
http://www.kb.cert.org/vuls/id/692417
http://www.securityfocus.com/archive/1/488071/100/0/threaded
http://www.securityfocus.com/bid/27656
http://www.securitytracker.com/id?1019374
http://www.us-cert.gov/cas/techalerts/TA08-043C.html
http://www.vupen.com/english/advisories/2008/0511/references
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-009
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5073
http://marc.info/?l=bugtraq&m=120361015026386&w=2
http://secunia.com/advisories/28901

Get alerted when CVE-2008-0109 or the next vulnerability affects your stack