CVE-2008-3012

gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 does not properly perform memory allocation, which allows remote attackers to execute arbitrary code via a malformed EMF image file, aka "GDI+ EMF Memory Corruption Vulnerability."

Published: 2008-09-11 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2008-3012 is rated High Risk (71.6/100): CVSS Critical severity, with high exploitation likelihood (EPSS 68.40%, 99th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2008-3012

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-28 68.53% 68.40% -0.13%
2 2025-12-27 68.40% 68.53% +0.13%
3 2025-12-18 68.40%

Full EPSS history (23 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2008-3012

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.3 2.0 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
8.6 10.0 [email protected]

Weakness enumeration for CVE-2008-3012

Affected software / configurations for CVE-2008-3012

Vendor Product Version Raw CPE
microsoft digital_image_suite 2006 cpe:2.3:a:microsoft:digital_image_suite:2006:*:*:*:*:*:*:*
microsoft forefront_client_security 1.0 cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:*
microsoft internet_explorer 6 cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
microsoft office 2003 cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*
microsoft office 2003 cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
microsoft office xp cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
microsoft office_powerpoint_viewer 2003 cpe:2.3:a:microsoft:office_powerpoint_viewer:2003:*:*:*:*:*:*:*
microsoft report_viewer 2005 cpe:2.3:a:microsoft:report_viewer:2005:sp1:*:*:*:*:*:*
microsoft report_viewer 2008 cpe:2.3:a:microsoft:report_viewer:2008:*:*:*:*:*:*:*
microsoft server 2008 cpe:2.3:a:microsoft:server:2008:*:*:*:*:*:*:*
microsoft sql_server 2005 cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:*
microsoft sql_server_reporting_services 2000 cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:*
microsoft visio 2002 cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*
microsoft works 8.0 cpe:2.3:a:microsoft:works:8.0:*:*:*:*:*:*:*
microsoft office_system cpe:2.3:o:microsoft:office_system:*:gold:*:*:*:*:*:*
microsoft office_system cpe:2.3:o:microsoft:office_system:*:sp1:*:*:*:*:*:*
microsoft windows 2003_server cpe:2.3:o:microsoft:windows:2003_server:sp1:*:*:*:*:*:*
microsoft windows 2003_server cpe:2.3:o:microsoft:windows:2003_server:sp2:*:*:*:*:*:*
microsoft windows-nt vista cpe:2.3:o:microsoft:windows-nt:vista:*:gold:*:*:*:*:*
microsoft windows-nt xp cpe:2.3:o:microsoft:windows-nt:xp:sp3:*:*:*:*:*:*
microsoft windows_vista cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
microsoft windows_xp cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

References for CVE-2008-3012

cvelogic Threat Intelligence