CVE-2008-3627 json
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov vid…
published 2008-09-10 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3613
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.6%
- EPSS 8.6% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
Patch / fix
Exploit prediction
8.62% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
References
-
securityfocus.com
/bid/31086
vdb-entry, patch, third-party-advisory
-
lists.apple.com
/archives/security-announce//2008/Sep/msg00000.html
vendor-advisory, mailing-list
-
support.apple.com
/kb/HT3027
vendor-advisory
-
zerodayinitiative.com
/advisories/ZDI-08-061/
third-party-advisory, vdb-entry
-
securityfocus.com
/archive/1/496176/100/0/threaded
mailing-list
-
vupen.com
/english/advisories/2008/2527
vdb-entry, third-party-advisory
-
securityfocus.com
/archive/1/496163/100/0/threaded
mailing-list
-
zerodayinitiative.com
/advisories/ZDI-08-060/
third-party-advisory, vdb-entry
-
securitytracker.com
/id?1020841
vdb-entry, third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16164
vdb-entry, signature, third-party-advisory
-
secunia.com
/advisories/31821
third-party-advisory
-
zerodayinitiative.com
/advisories/ZDI-08-062/
third-party-advisory, vdb-entry
-
securityfocus.com
/archive/1/496175/100/0/threaded
mailing-list
Sources
- CVE List CVE-2008-3627
- NVD CVE-2008-3627
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.