Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* | 8.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:* | 9.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* | 9.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:* | 2002 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* | 2003 sp1 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:* Versions 8.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:* Versions 9.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:* Versions 2002 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:* Versions 2003 sp1 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-3704
- 2026-10-03 Alias added: GHSA-x556-3584-m3v7
References
More Microsoft Visual Basic vulnerabilities
- TI-2012-01640 The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office… KEVCVSS 3.1HIGH 8.8
- TI-2012-00154 The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in… KEVCVSS 3.1HIGH 8.8
- TI-2003-00327 Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for… CVSS 2.0HIGH 10.0
- TI-2008-04076 Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or… CVSS 2.0HIGH 9.3
- TI-2007-00061 Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft… CVSS 2.0HIGH 10.0
- TI-2007-04622 Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows… CVSS 2.0HIGH 9.3
Sources
- CVE-2008-3704 · CVE Program
- CVE-2008-3704 · NVD
- FIRST EPSS
- GHSA-x556-3584-m3v7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences