Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Microsoft Word and related apps can run malicious code

CVE-2008-4837 · published 17 years ago
Summary

Certain versions of Microsoft Word, Word Viewer, the Office Compatibility Pack, and Microsoft Works can be tricked by a specially crafted document to execute unwanted code on a computer. This occurs when a malformed table in the document corrupts memory. Update to the latest patches or avoid opening suspicious documents to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft office 2004
2008
cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
microsoft office_compatibility_pack_for_word_excel_ppt_2007 All versions
cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:*:*:*:*:*:*:*
microsoft office_word_viewer 2003
cpe:2.3:a:microsoft:office_word_viewer:2003:*:*:*:*:*:*:*
microsoft open_xml_file_format_converter All versions
cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*
microsoft works 8.0
cpe:2.3:a:microsoft:works:8.0:*:*:*:*:*:*:*
microsoft office_outlook 2007
cpe:2.3:a:microsoft:office_outlook:2007:*:*:*:*:*:*:*
microsoft office_word 2000
2002
2003
2007
cpe:2.3:a:microsoft:office_word:2000:sp3:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 20...
Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Microsoft Works 8 allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed table property, which triggers memory corruption, aka "Word Memory Corruption Vulnerability."
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
37% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published10 Dec 2008
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2008-4837 · NVD
Track software like this
Free during beta