CVE-2008-0015: Microsoft DirectShow Video ActiveX Control Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityConfirmed in-the-wild exploitation, a CISA KEV listing with a near-term due date, and an EPSS score above the 99th percentile make this an urgent remediation item despite the age of the affected platforms.

What it is

A stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL) is reachable through the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow. A crafted web page can trigger the overflow and execute arbitrary code on affected Windows versions. The flaw was exploited in the wild in July 2009, making it a confirmed remote code execution issue rather than a theoretical one.

Impact

An attacker who gets the control instantiated gains arbitrary code execution in the context of the logged-on user. That permits installation of malware, data theft, or further lateral movement on the host.

Attack surface

Reached over the network via a crafted web page that instantiates the vulnerable ActiveX control; the CVSS vector shows no privileges required but user interaction required, so the victim must load the page in a browser that renders the control. No authentication is needed.

Exploitation

Exploitation is confirmed: the description states it was exploited in the wild in July 2009, multiple references carry the Exploit tag, and it is listed in CISA KEV with a 2026-03-10 remediation due date. EPSS is 0.767 (99.5th percentile), indicating high predicted exploitation activity.

What to do

• Apply the Microsoft security updates MS09-032 and MS09-037, which address the vulnerable ATL and DirectShow control.
• If patching cannot be completed immediately, apply the vendor workaround in Microsoft Security Advisory 972890, which disables the vulnerable control via the kill-bit registry setting.
• Disable or restrict ActiveX execution in browsers and enforce the kill-bit for msvidctl.dll across the estate.
• Retire or isolate Windows 2000 SP4, XP SP2/SP3, Server 2003 SP2, Vista, and Server 2008 Gold/SP2 systems that cannot be patched.
• Track KEV remediation against the 2026-03-10 due date and confirm closure.

Detection

• Hunt for processes loading msvidctl.dll, especially browser processes spawning child processes or making unexpected network connections.
• Monitor for registry changes to the kill-bit (Compatibility Flags) for the MPEG2TuneRequest control that could indicate tampering or re-enabling.
• Alert on exploit traffic or payload delivery tied to the known exploit references and US-CERT advisories for this CVE.
• Review proxy and browser logs for visits to pages hosting the crafted ActiveX exploit.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.