Zero-day vulnerability in Microsoft Word

Memory corruption

The vulnerability was being used in a 2008 Summer Olympics-themed attack.

Vulnerability details

Advisory: SB2008070801 - Remote code execution in Microsoft Word

Vulnerable component: Microsoft Word

CVE-ID: CVE-2008-2244

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C

CWE-ID: CWE-119 - Memory corruption


The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when handling malformed Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Known APT campaigns:

Summer Olympics-themed attack

The attack was discovered by TrendMicro. The hackers used malicious Excel file as TROJ_MDROPPER.ZY, and the PowerPoint file as TROJ_PPDROP.M