CVE-2008-4028

CVE-2008-4028 is a critical heap-based buffer overflow vulnerability affecting various Microsoft Office products, including Word, Outlook, and Office for Mac, as well as Word Viewer and the Office Compatibility Pack. It allows remote attackers to execute arbitrary code by crafting RTF files or rich text email messages containing malicious control words related to Drawing Object tags, leading to incorrect memory allocation. This vulnerability carries a CVSS score of 9.3, indicating high severity with a network-based attack vector, medium attack complexity, and complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 98/100, and its EPSS score is exceptionally high, suggesting a significant likelihood of exploitation. Despite its high severity and EPSS score, there is no evidence of active exploitation (not in KEV or Hot List), nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also minimal, which is typical for the vast majority of CVEs.