CVE-2008-2547
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows...
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
- Record
CVE-2008-2547- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
- Record
CVE-2008-2547- Updated
- 2026-11-02
EUVDEUVD-2008-2542 No score
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
- Record
EUVD-2008-2542- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w4j8-hmfc-m6g9 No score
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows...
Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if msiexec.exe is reachable via components such as ActiveX controls, and might additionally require a separate vulnerability in the control.
- Record
GHSA-w4j8-hmfc-m6g9- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2547 is a high vulnerability (CVSS 9.3) in Microsoft Windows Installer, published June 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.49%, the 95th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/492992/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/42887
aushack.com/200806-msiexec.txt
nvd.nist.gov/vuln/detail/CVE-2008-2547
github.com/advisories/GHSA-w4j8-hmfc-m6g9