Vulnerability record · CVE-2008-0108 · published 12 February 2008
CVE-2008-0108: Microsoft Works File Converter Stack Buffer Overflow via Crafted .wps File
Microsoft · Office
A stack-based buffer overflow exists in wkcvqd01.dll, the Microsoft Works 6 File Converter used by Office 2003 SP2/SP3, Works 8.0 and Works Suite 2005. A .wps file with crafted field lengths overflows a stack buffer, allowing remote code execution in the context of the user who opens the file. The flaw is a classic memory corruption issue in a document parsing component.
Description
Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted field lengths, aka "Microsoft Works File Converter Field Length Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityCVSS 9.3 and high EPSS with public exploit code make this a serious remote code execution risk, though it requires user interaction and affects legacy products.
What it is
A stack-based buffer overflow exists in wkcvqd01.dll, the Microsoft Works 6 File Converter used by Office 2003 SP2/SP3, Works 8.0 and Works Suite 2005. A .wps file with crafted field lengths overflows a stack buffer, allowing remote code execution in the context of the user who opens the file. The flaw is a classic memory corruption issue in a document parsing component.
Impact
An attacker who gets a victim to open a malicious .wps file can execute arbitrary code with the victim's privileges, leading to full compromise of confidentiality, integrity and availability. No privilege escalation is required beyond the user's own rights.
Attack surface
The vector is network-reachable (AV:N) but requires medium complexity (AC:M) and no authentication (Au:N); exploitation depends on the victim opening or previewing a crafted .wps file, so user interaction is effectively required. The vulnerable code path is the Works file converter DLL loaded when such a document is processed.
Exploitation
The record is not listed in CISA KEV and no ransomware associations are documented, but EPSS is high (0.526, 98.9th percentile) and a public Exploit-DB entry (5107) exists, indicating exploit code is available. No reference tag explicitly confirms in-the-wild exploitation.
What to do
- Apply Microsoft security bulletin MS08-011 to update the affected Works File Converter components.
- Block or strip .wps attachments at email and web gateways, and restrict opening of untrusted Works documents.
- Disable or unregister the vulnerable wkcvqd01.dll converter where Works document conversion is not needed.
- Run Office/Works with least privilege and enable DEP/ASLR protections on endpoints that must handle these files.
- Educate users not to open unexpected .wps files from email or downloads.
Detection
- Monitor for processes loading wkcvqd01.dll, especially from email client or Office parent processes.
- Alert on Office/Works applications spawning child processes such as cmd.exe or powershell.exe after opening a document.
- Search endpoint logs for crashes or access violations in wkcvqd01.dll correlated with .wps file opens.
- Hunt for .wps files arriving as email attachments or downloads from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-0108 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-0108), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
