VULNERABILITY INTELLIGENCE
CVE-2008-3475
CVSS score8.8 HIGH
EPSS probability39.86%
CISA KEVNot currently listed
Published2008-10-15
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."
Weakness classification
- CWE-908: Use of Uninitialized Resource
Primary references
- secure@microsoft.com — Issue Tracking, Third Party Advisory
- secure@microsoft.com — Mailing List
- secure@microsoft.com — Broken Link, Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link, Patch, Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link, Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link, Third Party Advisory, US Government Resource
- secure@microsoft.com — Broken Link
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Patch, Vendor Advisory
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Third Party Advisory, VDB Entry
- secure@microsoft.com — Broken Link