CVE-2008-1088

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote...

9.3 High

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory resource allocations."

Exploit likelihood

31.9%Down 14.8 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2008-1088
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-1088
Updated: 2026-11-02

EUVDEUVD-2008-1099 No score

Record: EUVD-2008-1099
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r3p6-4j7v-2gpw No score

Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote...

Record: GHSA-r3p6-4j7v-2gpw
Updated: 2026-11-02

Affected products

microsoft project

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-1088 is a high vulnerability (CVSS 9.3) in Microsoft Project, published April 8, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 31.9%, the 98th percentile. No source names a fixed version.

References

Show 6 moreShow less