CVE-2008-2540

Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a "Carpet Bomb" and a "Blended Threat Elevation of Privilege Vulnerability," a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.

Published: 2008-06-03 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2008-2540 is rated High Risk (65.2/100): CVSS Critical severity, with high exploitation likelihood (EPSS 8.31%, 94th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2008-2540

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 43.14% 8.31% -34.83%
2 2026-02-02 46.40% 43.14% -3.26%
3 2025-12-28 46.40%

Full EPSS history (23 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2008-2540

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.3 2.0 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
8.6 10.0 [email protected]

Weakness enumeration for CVE-2008-2540

Affected software / configurations for CVE-2008-2540

Vendor Product Version Raw CPE
apple safari < 3.1.2 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

References for CVE-2008-2540

URL Tags
http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx Third Party Advisory
http://blogs.zdnet.com/security/?p=1230 Third Party Advisory
http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html Mailing List Vendor Advisory
http://secunia.com/advisories/30467 Third Party Advisory
http://securitytracker.com/id?1020150 Third Party Advisory VDB Entry
http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm Third Party Advisory
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138 Third Party Advisory
http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html Broken Link
http://www.microsoft.com/technet/security/advisory/953818.mspx Mitigation Patch Vendor Advisory
http://www.securityfocus.com/bid/29445 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1022047 Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-104A.html Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2008/1706 Broken Link
http://www.vupen.com/english/advisories/2009/1028 Broken Link
http://www.vupen.com/english/advisories/2009/1029 Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015
https://exchange.xforce.ibmcloud.com/vulnerabilities/42765 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509 Third Party Advisory
cvelogic Threat Intelligence