CVE-2008-4254

Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability."

• CWE-189

• http://secunia.com/secunia_research/2007-72/Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
• http://www.securityfocus.com/archive/1/499059/100/0/threaded
• http://www.securitytracker.com/id?1021369
• http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/3382Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805
• http://secunia.com/secunia_research/2007-72/Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
• http://www.securityfocus.com/archive/1/499059/100/0/threaded
• http://www.securitytracker.com/id?1021369
• http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/3382Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805

Published

Dec 10, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4248Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4249Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4250The Server service in Microsoft Windows 2000 SP4, XP SP2 and…9.8
• CVE-2008-4251Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4252The DataGrid ActiveX control in Microsoft Visual Basic 6.0 a…
• CVE-2008-4253The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, …
• CVE-2008-4255Heap-based buffer overflow in mscomct2.ocx (aka Windows Comm…
• CVE-2008-4256The Charts ActiveX control in Microsoft Visual Basic 6.0, Vi…
• CVE-2008-4257Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4258Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not prop…
• CVE-2008-4259Microsoft Internet Explorer 7 sometimes attempts to access u…
• CVE-2008-4260Microsoft Internet Explorer 7 sometimes attempts to access a…