CVE-2008-3471
CriticalStack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac;…
Published Oct 14, 2008 · Updated Apr 22, 2026
Key Facts
Patch immediately- CVE-2008-3471 is a critical-severity vulnerability (CVSS 9.3 v2) affecting Excel (Microsoft), Excel Viewer (Microsoft), Office (Microsoft) and 2 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 52% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
52%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2008-3471 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."
Affected Products
12 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ExcelMicrosoft | 2003-sp2, 2003-sp3, 2007, 2007-sp1 | n/a |
| Excel ViewerMicrosoft | 2003, 2003-sp3 | n/a |
| OfficeMicrosoft | 2004, 2008 | n/a |
| Office Compatibility PackMicrosoft | 2007, 2007-sp1 | n/a |
| Open XML File Format ConverterMicrosoft | See advisory | n/a |
Timeline
Publicly disclosed
Oct 14, 2008
Last updated
Apr 22, 2026
Weakness Type
- CWE-787 Out-of-bounds Write
References
- advisorySSRT080143
- advisoryexcel-file-format-code-execution(45579)
- advisorywin-ms08kb956416-update(45581)
- advisoryoval:org.mitre.oval:def:5750
- advisory1021044
FAQ
Common Questions.
Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for M…
Affected: Excel (Microsoft) versions 2003-sp2, 2003-sp3, 2007, 2007-sp1; Excel Viewer (Microsoft) versions 2003, 2003-sp3; Office (Microsoft) versions 2004, 2008, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2008-3471 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo