CVE-2008-3013

gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a malformed GIF image file containing many extension markers for graphic control extensions and subsequent unknown labels, aka "GDI+ GIF Parsing Vulnerability."

• CWE-399

• http://ifsec.blogspot.com/2008/09/windows-gdi-gif-memory-corruption.html
• http://marc.info/?l=bugtraq&m=122235754013992&w=2
• http://secunia.com/advisories/32154Vendor Advisory
• http://www.securityfocus.com/archive/1/496154/100/0/threaded
• http://www.securityfocus.com/bid/31020
• http://www.securitytracker.com/id?1020836
• http://www.us-cert.gov/cas/techalerts/TA08-253A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2520Vendor Advisory
• http://www.vupen.com/english/advisories/2008/2696Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-08-056
• http://www.zerodayinitiative.com/advisories/ZDI-08-056/
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-052
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5986
• http://ifsec.blogspot.com/2008/09/windows-gdi-gif-memory-corruption.html
• http://marc.info/?l=bugtraq&m=122235754013992&w=2
• http://secunia.com/advisories/32154Vendor Advisory
• http://www.securityfocus.com/archive/1/496154/100/0/threaded
• http://www.securityfocus.com/bid/31020
• http://www.securitytracker.com/id?1020836
• http://www.us-cert.gov/cas/techalerts/TA08-253A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2520Vendor Advisory
• http://www.vupen.com/english/advisories/2008/2696Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-08-056
• http://www.zerodayinitiative.com/advisories/ZDI-08-056/
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-052
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5986

Published

Sep 11, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3007Argument injection vulnerability in a URI handler in Microso…
• CVE-2008-3008Stack-based buffer overflow in the WMEncProfileManager Activ…
• CVE-2008-3009Microsoft Windows Media Player 6.4, Windows Media Format Run…
• CVE-2008-3010Microsoft Windows Media Player 6.4, Windows Media Format Run…
• CVE-2008-3011Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-3012gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Wi…
• CVE-2008-3014Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet…
• CVE-2008-3015Integer overflow in gdiplus.dll in GDI+ in Microsoft Office …
• CVE-2008-3016Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-3017Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-3018Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Conv…
• CVE-2008-3019Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Conv…