CVE-2008-3015

Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a BMP image file with a malformed BitMapInfoHeader that triggers a buffer overflow, aka "GDI+ BMP Integer Overflow Vulnerability."

• CWE-189

• http://marc.info/?l=bugtraq&m=122235754013992&w=2
• http://secunia.com/advisories/32154Vendor Advisory
• http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability.txt
• http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability_ver2.txt
• http://www.securityfocus.com/archive/1/496153/100/0/threaded
• http://www.securityfocus.com/bid/31022
• http://www.securitytracker.com/id?1020838
• http://www.us-cert.gov/cas/techalerts/TA08-253A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2520Vendor Advisory
• http://www.vupen.com/english/advisories/2008/2696Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-08-055
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-052
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5881
• https://www.exploit-db.com/exploits/6619
• https://www.exploit-db.com/exploits/6716
• http://marc.info/?l=bugtraq&m=122235754013992&w=2
• http://secunia.com/advisories/32154Vendor Advisory
• http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability.txt
• http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability_ver2.txt
• http://www.securityfocus.com/archive/1/496153/100/0/threaded
• http://www.securityfocus.com/bid/31022
• http://www.securitytracker.com/id?1020838
• http://www.us-cert.gov/cas/techalerts/TA08-253A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2520Vendor Advisory
• http://www.vupen.com/english/advisories/2008/2696Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-08-055
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-052
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5881
• https://www.exploit-db.com/exploits/6619
• https://www.exploit-db.com/exploits/6716

Published

Sep 11, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3009Microsoft Windows Media Player 6.4, Windows Media Format Run…
• CVE-2008-3010Microsoft Windows Media Player 6.4, Windows Media Format Run…
• CVE-2008-3011Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-3012gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Wi…
• CVE-2008-3013gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Wi…
• CVE-2008-3014Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet…
• CVE-2008-3016Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-3017Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-3018Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Conv…
• CVE-2008-3019Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Conv…
• CVE-2008-3020Microsoft Office 2000 SP3 and XP SP3; Office Converter Pack;…
• CVE-2008-3021Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Conv…