Skip to content
Fencer Vulns
critical 9.3

CVE-2008-3477 in the critical feed json

Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Of…

published 2008-10-15 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3463

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
35.7%
EPSS 35.7% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object, which allows remote attackers to execute arbitrary code via an Excel file containing a crafted value, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption, aka "Calendar Object Validation Vulnerability."

Patch / fix

Exploit prediction

35.69% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-399 Resource Management Errors

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.