CVE-2008-4255

Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

• CWE-119

• http://downloads.securityfocus.com/vulnerabilities/exploits/32613.plExploit
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
• http://www.securityfocus.com/archive/1/499061/100/0/threaded
• http://www.securityfocus.com/bid/32613Patch
• http://www.securitytracker.com/id?1021369
• http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/3382Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-08-083
• http://www.zerodayinitiative.com/advisories/ZDI-08-083/
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6032
• http://downloads.securityfocus.com/vulnerabilities/exploits/32613.plExploit
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
• http://www.securityfocus.com/archive/1/499061/100/0/threaded
• http://www.securityfocus.com/bid/32613Patch
• http://www.securitytracker.com/id?1021369
• http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/3382Vendor Advisory
• http://www.zerodayinitiative.com/advisories/ZDI-08-083
• http://www.zerodayinitiative.com/advisories/ZDI-08-083/
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6032

Published

Dec 10, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4249Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4250The Server service in Microsoft Windows 2000 SP4, XP SP2 and…9.8
• CVE-2008-4251Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4252The DataGrid ActiveX control in Microsoft Visual Basic 6.0 a…
• CVE-2008-4253The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, …
• CVE-2008-4254Multiple integer overflows in the Hierarchical FlexGrid Acti…
• CVE-2008-4256The Charts ActiveX control in Microsoft Visual Basic 6.0, Vi…
• CVE-2008-4257Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-4258Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not prop…
• CVE-2008-4259Microsoft Internet Explorer 7 sometimes attempts to access u…
• CVE-2008-4260Microsoft Internet Explorer 7 sometimes attempts to access a…
• CVE-2008-4261Stack-based buffer overflow in Microsoft Internet Explorer 5…