CVE-2008-1083
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows...
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
Exploit likelihood
What each source reports
CVE List
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
- Record
CVE-2008-1083- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2008-1094
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
- Record
EUVD-2008-1094- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8pgm-3m7v-29vc
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows...
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
- Record
GHSA-8pgm-3m7v-29vc- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-190
- Updated
- 2026-11-02
NVD
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF or WMF image file with a malformed header that triggers an integer overflow, aka "GDI Heap Overflow Vulnerability."
- Record
CVE-2008-1083- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119, CWE-190
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021) | 2008-04-14 |
| Exploit-DB | Microsoft Windows - GDI (CreateDIBPatternBrushPt) Heap Overflow (PoC) | 2008-08-29 |
| Exploit-DB | Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021) | 2008-10-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1083 is a high vulnerability (CVSS 9.3) in Microsoft Windows 2000, published April 8, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 57.0%, the 99th percentile. No source names a fixed version.
References
securityfocus.com/bid/30933
us-cert.gov/cas/techalerts/TA08-099A.html
osvdb.org/44213
marc.info?l=bugtraq&m=120845064910729&w=2
vupen.com/english/advisories/2008/1145/references
support.microsoft.com/kb/948590
Show 16 moreShow less
archives.neohapsis.com/archives/fulldisclosure/2008-04/0168.html
labs.idefense.com/intelligence/vulnerabilities/display.php?id=681
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-021
zerodayinitiative.com/advisories/ZDI-08-020
kb.cert.org/vuls/id/632963
exploit-db.com/exploits/5442
exchange.xforce.ibmcloud.com/vulnerabilities/41471
securitytracker.com/id?1019798
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5441
secunia.com/advisories/29704
nvd.nist.gov/vuln/detail/CVE-2008-1083
github.com/advisories/GHSA-8pgm-3m7v-29vc