CVE-2008-2463

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 59.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-07-07 · updated 2026-06-16
Weakness: CWE-94

Description

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Affected products

Microsoft Office Snapshot Viewer Activex: office_2003, office_xp, office2000

References

http://marc.info/?l=bugtraq&m=121915960406986&w=2
http://secunia.com/advisories/30883
http://www.exploit-db.com/exploits/6124
http://www.kb.cert.org/vuls/id/837785
http://www.microsoft.com/technet/security/advisory/955179.mspx
http://www.securityfocus.com/bid/30114
http://www.securitytracker.com/id?1020433
http://www.us-cert.gov/cas/techalerts/TA08-189A.html
http://www.us-cert.gov/cas/techalerts/TA08-225A.html
http://www.vupen.com/english/advisories/2008/2012/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/43613
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6120

Get alerted when CVE-2008-2463 or the next vulnerability affects your stack