CVE-2008-3465

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a denial of service or execute arbitrary code via a WMF file with a malformed file-size parameter, which would not be properly handled by a third-party application that uses this API for a copy operation, aka "GDI Heap Overflow Vulnerability."

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-346610.0Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote atta CVE-2008-34719.3Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Of CVE-2008-34729.3Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att CVE-2008-34739.3Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att CVE-2008-34746.5Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att CVE-2008-34758.8Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (CVE-2008-34769.3Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remo CVE-2008-34779.3Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Off CVE-2008-347910.0Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers CVE-2008-34809.3Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Print Wizard, allows re CVE-2008-34817.5themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a d CVE-2008-34824.3Cross-site scripting (XSS) vulnerability in the error page feature in Panasonic Network Camera BL-C111, BL-C131, BB-HCM511, BB-HCM531, BB-HC