CVE-2008-3627
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within...
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
Exploit likelihood
What each source reports
NVD Score used
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
- Record
CVE-2008-3627- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
- Record
CVE-2008-3627- Updated
- 2026-11-02
EUVDEUVD-2008-3613 No score
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
- Record
EUVD-2008-3613- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r8gq-4fh4-57x5 No score
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within...
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
- Record
GHSA-r8gq-4fh4-57x5- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3627 is a high vulnerability (CVSS 9.3) in Apple Quicktime, published September 10, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.62%, the 95th percentile. No source names a fixed version.
References
zerodayinitiative.com/advisories/ZDI-08-061
securityfocus.com/bid/31086
vupen.com/english/advisories/2008/2527
lists.apple.com/archives/security-announce//2008/Sep/msg00000.html
Show 9 moreShow less
securitytracker.com/id?1020841
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16164
support.apple.com/kb/HT3027
secunia.com/advisories/31821
nvd.nist.gov/vuln/detail/CVE-2008-3627
github.com/advisories/GHSA-r8gq-4fh4-57x5