CVE-2008-3704
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and...
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
- Record
CVE-2008-3704- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
- Record
CVE-2008-3704- Updated
- 2026-11-02
EUVDEUVD-2008-3690 No score
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
- Record
EUVD-2008-3690- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x556-3584-m3v7 No score
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and...
Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability."
- Record
GHSA-x556-3584-m3v7- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Visual Studio - Msmask32.ocx ActiveX Buffer Overflow (MS08-070) (Metasploit) | 2010-11-24 |
| Exploit-DB | Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow (PoC) | 2008-08-14 |
| Exploit-DB | Microsoft Visual Studio - 'Msmask32.ocx' ActiveX Remote Buffer Overflow | 2008-08-26 |
| Metasploit | Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow | 2008-08-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3704 is a high vulnerability (CVSS 9.3) in Microsoft Visual Basic, published August 18, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 55.9%, the 99th percentile. No source names a fixed version.
References
securitytracker.com/id?1020710
vupen.com/english/advisories/2008/2380
secunia.com/advisories/31498
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5794
securityfocus.com/bid/30674
Show 8 moreShow less
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
exploit-db.com/exploits/6244
support.avaya.com/elmodocs2/security/ASA-2008-473.htm
us-cert.gov/cas/techalerts/TA08-344A.html
exchange.xforce.ibmcloud.com/vulnerabilities/44444
nvd.nist.gov/vuln/detail/CVE-2008-3704
github.com/advisories/GHSA-x556-3584-m3v7