Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a craf…

published 2008-04-08 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1099

cvss: 9.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 31.9%; EPSS 31.9% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations."

Patch / fix

links 2

securityfocus.com/bid/28607 patch
secunia.com/advisories/29690 advisory

Exploit prediction

31.93% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-399 Resource Management Errors

References

securityfocus.com /bid/28607
vdb-entry, patch
secunia.com /advisories/29690
third-party-advisory, patch, vendor-advisory
marc.info /?l=bugtraq&m=120845064910729&w=2
vendor-advisory
docs.microsoft.com /en-us/security-updates/securitybulletins/2008/ms08-018
vendor-advisory
us-cert.gov /cas/techalerts/TA08-099A.html
third-party-advisory, us-government-resource
vupen.com /english/advisories/2008/1142/references
vdb-entry
exchange.xforce.ibmcloud.com /vulnerabilities/41447
vdb-entry
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5384
vdb-entry, signature
kb.cert.org /vuls/id/155563
third-party-advisory, us-government-resource
securitytracker.com /id?1019797
vdb-entry

Sources

CVE List CVE-2008-1088
NVD CVE-2008-1088

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary