CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2008-3465

CVSS 9.8v3.1pub. 2008-12-10upd. 2026-04-23

Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a denial of service or execute arbitrary code via a WMF file with a malformed file-size parameter, which would not be properly handled by a third-party application that uses this API for a copy operation, aka "GDI Heap Overflow Vulnerability."

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Microsoft Windows 2000

    OS
    Microsoft
    all versions

  • Microsoft Windows 2003 Server

    OS
    Microsoft
    all versions

  • Microsoft Windows Server 2003

    OS
    Microsoft
    all versions

  • Microsoft Windows Server 2008

    OS
    Microsoft
    all versions

  • Microsoft Windows Vista

    OS
    Microsoft
    gold

  • Microsoft Windows Xp

    OS
    Microsoft
    all versions
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEDoSMemory
CWE
References

Related vulnerabilities

CVE-2020-1040CRITICAL9.0⚠ KEVPL ✓same product

RCE w Hyper-V RemoteFX vGPU — błąd walidacji wejścia od gościa

CVE-2020-1350CRITICAL10.0⚠ KEVPL ✓same product

RCE w Windows DNS Server — krytyczna podatność SIGRed (CVSS 10.0)

CVE-2020-0646CRITICAL9.8⚠ KEVPL ✓same product

RCE w Microsoft .NET Framework — nieprawidłowa walidacja danych wejściowych

CVE-2019-0708CRITICAL9.8⚠ KEVPL ✓same product

BlueKeep — krytyczny RCE w Remote Desktop Services (RDP)

CVE-2017-8543CRITICAL9.8⚠ KEVPL ✓same product

RCE w Windows Search — przejęcie kontroli nad systemem