Cyber Resilience

CVE-2008-0081

Microsoft Excel 2000 … 2003

High EPSS
Published
16 January 2008
Modified
23 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.58 99th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2008-0081 is a critical-severity Use of Uninitialized Resource (CWE-908) vulnerability in Microsoft Excel. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.

CWE(s)
CWE-908

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1204.002 Malicious File Executionconfidence: HIGH
User-assisted execution of crafted malicious macros in Excel directly enables this technique.
attack.mitre.org →
T1059.005 Visual Basic Executionconfidence: HIGH
The vulnerability allows execution of arbitrary code via crafted macros, which are Visual Basic for Applications (VBA).
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-49029Same product: Microsoft Excel
CVE-2009-3129Same product: Microsoft Excel
CVE-2025-53759Same product: Microsoft Office
CVE-2025-21357Same product: Microsoft Office
CVE-2026-55949Same product: Microsoft Excel
CVE-2009-0238Same product: Microsoft Excel
CVE-2025-21272Same vendor: Microsoft
CVE-2023-38151Same vendor: Microsoft
CVE-2023-36567Same vendor: Microsoft
CVE-2025-49718Same vendor: Microsoft

Affected Assets

microsoft
excel
2000, 2002, 2003
microsoft
excel viewer
2003
microsoft
office
2004

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC activities such as static analysis and code review directly prevent use of uninitialized resources while also addressing many other weaknesses.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development and acceptance can detect uninitialized resource usage through dynamic analysis and fuzzing.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates initialization checks and static analysis that can catch uninitialized resource use.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify mandatory initialization of variables and resources before use.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles include defensive coding practices that prevent use of uninitialized memory or objects.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly require explicit initialization of all variables and resources, substantially mitigating CWE-908.

References