Security Resilience

CVE-2008-0015

Memory Safety in Microsoft Windows 2003 Server

CISA KEVActive ExploitationEUVD ExploitedPublic PoCMemory Safety
Published
07 July 2009
Modified
21 April 2026
KEV Added
17 February 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.77 99.5th percentile
Risk Priority 90 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2008-0015 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Microsoft Windows 2003 Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique /etc/passwd and /etc/shadow (T1003.008); ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a stack-based buffer overflow in the CComVariant::ReadFromStream function within the Active Template Library (ATL), specifically affecting the MPEG2TuneRequest ActiveX control implemented in msvidctl.dll as part of DirectShow. It impacts multiple Microsoft Windows releases, including 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista Gold/SP1/SP2, and Server 2008 Gold/SP2. The flaw is tracked under CWE-119 and CWE-121 with a CVSS 3.1 score of 8.8.

Remote attackers can exploit the issue by serving a crafted web page that triggers the overflow when the ActiveX control processes the input stream, resulting in arbitrary code execution on the target system. No authentication is required, and the attack vector is network-based with user interaction via a browser.

Public references, including Microsoft Security Research and Defense blog posts and Secunia advisory 36187, address related patches such as those issued under MS09-037 and note reuse of CVE identifiers from prior ATL fixes. Additional sources such as SANS ISC and OSVDB entries document the issue and link to vendor guidance.

The vulnerability was exploited in the wild in July 2009, shortly after public disclosure.

EU & UK References

Vulnerability Data

Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and…

more

SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."

CWE(s)
CWE-119CWE-121
KEV Date Added
17 February 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1012 Query Registry Discovery
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
attack.mitre.org →
T1016.002 Wi-Fi Discovery Discovery
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
attack.mitre.org →
T1020 Automated Exfiltration Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.
attack.mitre.org →
T1020.001 Traffic Duplication Exfiltration
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2015-2360Same vendor: Microsoftboth on KEV
CVE-2015-2426Same vendor: Microsoftboth on KEV
CVE-2023-36033Same vendor: Microsoftboth on KEV
CVE-2008-4250Same product: Microsoft Windows Xpboth on KEV
CVE-2008-1083Same product: Microsoft Windows 2003 Server
CVE-2013-3660Same product: Microsoft Windows Xpboth on KEV
CVE-2024-20689Same vendor: Microsoft
CVE-2026-69510Same vendor: Microsoft
CVE-2026-70344Same vendor: Microsoft
CVE-2026-69301Same vendor: Microsoft

Affected Assets

microsoft
windows 2003 server
all versions
microsoft
windows xp
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-11 Developer Testing and Evaluation
addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

SC-27 Platform-independent Applications
addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

SI-16 Memory Protection
addresses: CWE-119

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

SI-4 System Monitoring
addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.RA-01 partial match
blocks

Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.

PR.PS-02 partial match
blocks

Patching eliminates known instances of the weakness after discovery.

PR.PS-06 partial match
blocks

Secure-development practices directly prevent introduction of stack buffer overflows.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248594 OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. blocks CWE-121
Oracle Linux 9 (1 rule)
  • V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. blocks CWE-121

References