CVE-2008-0015

Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."

• CWE-119
• CWE-121

• http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspxBroken Link
• http://isc.sans.org/diary.html?storyid=6733Exploit
• http://osvdb.org/55651Broken Link
• http://secunia.com/advisories/36187Broken Link
• http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799Exploit
• http://www.iss.net/threats/329.htmlExploit
• http://www.kb.cert.org/vuls/id/180513US Government Resource
• http://www.microsoft.com/technet/security/advisory/972890.mspxVendor Advisory
• http://www.securityfocus.com/bid/35558Broken Link
• http://www.securityfocus.com/bid/35585Broken Link
• http://www.securitytracker.com/id?1022514Broken Link
• http://www.us-cert.gov/cas/techalerts/TA09-187A.htmlUS Government Resource
• http://www.us-cert.gov/cas/techalerts/TA09-195A.htmlUS Government Resource
• http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2232Broken Link
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032Third Party Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037Third Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436Broken Link
• http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspxBroken Link
• http://isc.sans.org/diary.html?storyid=6733Exploit
• http://osvdb.org/55651Broken Link
• http://secunia.com/advisories/36187Broken Link
• http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799Exploit
• http://www.iss.net/threats/329.htmlExploit
• http://www.kb.cert.org/vuls/id/180513US Government Resource
• http://www.microsoft.com/technet/security/advisory/972890.mspxVendor Advisory
• http://www.securityfocus.com/bid/35558Broken Link
• http://www.securityfocus.com/bid/35585Broken Link
• http://www.securitytracker.com/id?1022514Broken Link
• http://www.us-cert.gov/cas/techalerts/TA09-187A.htmlUS Government Resource
• http://www.us-cert.gov/cas/techalerts/TA09-195A.htmlUS Government Resource
• http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2232Broken Link
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032Third Party Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037Third Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436Broken Link
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-0015US Government Resource

Published

Jul 7, 2009

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0009The vmsplice_to_user function in fs/splice.c in the Linux ke…
• CVE-2008-0010The copy_from_user_mmap_sem function in fs/splice.c in the L…
• CVE-2008-0011Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft…
• CVE-2008-0012Heap-based buffer overflow in an unspecified procedure in Tr…
• CVE-2008-0013Heap-based buffer overflow in an unspecified procedure in Tr…
• CVE-2008-0014Heap-based buffer overflow in an unspecified procedure in Tr…
• CVE-2008-0016Stack-based buffer overflow in the URL parsing implementatio…
• CVE-2008-0017The http-index-format MIME type parser (nsDirIndexParser) in…
• CVE-2008-0020Unspecified vulnerability in the Load method in the IPersist…
• CVE-2008-0026SQL injection vulnerability in Cisco Unified CallManager/Com…
• CVE-2008-0027Heap-based buffer overflow in the Certificate Trust List (CT…
• CVE-2008-0028Unspecified vulnerability in Cisco PIX 500 Series Security A…