CVE-2008-4264

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula, which triggers "pointer corruption" during the loading of formulas from this spreadsheet, aka "File Format Parsing Vulnerability."

Published: 2008-12-10 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2008-4264 is rated High Risk (67.5/100): CVSS Critical severity, with high exploitation likelihood (EPSS 62.48%, 98th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2008-4264

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-06-28 66.53% 62.48% -4.05%
2 2025-05-01 68.46% 66.53% -1.93%
3 2025-03-30 68.46%

Full EPSS history (23 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2008-4264

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.3 2.0 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
8.6 10.0 [email protected]

Weakness enumeration for CVE-2008-4264

NVD evaluator notes for CVE-2008-4264

Comment: http://www.microsoft.com/technet/security/Bulletin/MS08-074.mspx File Format Parsing Vulnerability - CVE-2008-4264 A remote code execution vulnerability exists in Microsoft Office Excel as a result of pointer corruption when loading Excel formulas. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed formula. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Affected software / configurations for CVE-2008-4264

Vendor Product Version Raw CPE
microsoft office_excel 2000 cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*
microsoft office_excel 2002 cpe:2.3:a:microsoft:office_excel:2002:sp3:*:*:*:*:*:*
microsoft office_excel 2003 cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*
microsoft office 2004 cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
microsoft office 2008 cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
microsoft office_compatibility_pack_for_word_excel_ppt_2007 cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:*:*:*:*:*:*:*
microsoft office_compatibility_pack_for_word_excel_ppt_2007 cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*
microsoft office_excel_viewer cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
microsoft office_excel_viewer 2003 cpe:2.3:a:microsoft:office_excel_viewer:2003:*:*:*:*:*:*:*
microsoft office_excel_viewer 2003 cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*
microsoft open_xml_file_format_converter cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*

References for CVE-2008-4264

cvelogic Threat Intelligence