CVE-2008-0015
Published 2009-07-07 · Updated 2026-06-16 · Source cve@mitre.org
Summary
CVE-2008-0015 is a high-severity (CVSS 8.8) vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalog on February 17, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 10, 2026. CISA does not currently list it as used in ransomware campaigns. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.
All 390 known-exploited Microsoft vulnerabilities →Description
Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Microsoft — Windows
Name: Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
Date added: 2026-02-17 · Due: 2026-03-10
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
- http://isc.sans.org/diary.html?storyid=6733
- http://osvdb.org/55651
- http://secunia.com/advisories/36187
- http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799
- http://www.iss.net/threats/329.html
- http://www.kb.cert.org/vuls/id/180513
- http://www.microsoft.com/technet/security/advisory/972890.mspx