CVE-2008-0116 describes a critical remote code execution vulnerability affecting multiple Microsoft Excel versions (2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004/2008 for Mac). This flaw allows attackers to execute arbitrary code on a user's system by crafting malicious rich text tags within an Excel file, requiring user interaction to open the file. With a CVSS score of 9.3, this vulnerability is highly severe, indicating a network-based attack with medium complexity that can lead to complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an ExploitDB entry (EDB-5287) exists, suggesting proof-of-concept code is available, though there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2000CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2000:sp3:*:*:*:*:*:* | ||
2002CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:* | ||
2003CPE matchmatch criteria | cpe:2.3:a:microsoft:excel:2003:sp2:*:*:*:*:*:* | ||
2003CPE matchmatch criteria | cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* | ||
2004CPE matchmatch criteria | cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.