Read the docs
TI-2008-00010 Aliases CVE-2008-0011GHSA-q2hg-79w4-xr3v

Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft XP SP2 and SP3, Server 2003…

Priority MEDIUM 64CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, does not properly perform MJPEG error checking, which allows remote attackers to execute arbitrary code via a crafted MJPEG stream in a (1) AVI or (2) ASF file, aka the "MJPEG Decoder Vulnerability."

Why it matters now

EPSS 0.31589 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*xp sp3Running onMicrosoft
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_2003_server:*:sp1:itanium:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*all versionsRunning onMicrosoft
  • cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:* Versions xp sp3 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp1:itanium:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:a:microsoft:directx:9.0:*:*:*:*:*:*:*9.0VulnerableMicrosoft
cpe:2.3:a:microsoft:directx:7.0:*:*:*:*:*:*:*7.0VulnerableMicrosoft
cpe:2.3:a:microsoft:directx:8.1:*:*:*:*:*:*:*8.1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows-nt:2008:*:itanium:*:*:*:*:*2008Running onMicrosoft
cpe:2.3:o:microsoft:windows-nt:2008:*:x32:*:*:*:*:*2008Running onMicrosoft
cpe:2.3:o:microsoft:windows-nt:2008:*:x64:*:*:*:*:*2008Running onMicrosoft
cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:a:microsoft:directx:10.0:*:*:*:*:*:*:*10.0VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:a:microsoft:directx:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:directx:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:directx:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows-nt:2008:*:itanium:*:*:*:*:* Versions 2008 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows-nt:2008:*:x32:*:*:*:*:* Versions 2008 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows-nt:2008:*:x64:*:*:*:*:* Versions 2008 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:a:microsoft:directx:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-0011
  2. 2026-10-03 Alias added: GHSA-q2hg-79w4-xr3v

References

Advisory 3

Other 2

  • TI-2009-01458 Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in… KEVCVSS 3.1HIGH 8.8
  • TI-2008-01384 Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows… CVSS 2.0HIGH 9.3
  • TI-2007-03780 Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange… CVSS 2.0HIGH 8.5
  • TI-2007-03775 Buffer overflow in Microsoft DirectShow in Microsoft DirectX 7.0 through 10.0 allows… CVSS 2.0HIGH 9.3
  • TI-2009-00078 Use-after-free vulnerability in DirectShow in Microsoft DirectX 8.1 and 9.0 allows remote… CVSS 2.0HIGH 9.3
  • TI-2009-01460 The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0… CVSS 2.0HIGH 9.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences