{"cve":"CVE-2008-2463","nvd":{"published":"2008-07-07T23:41:00.000","modified":"2026-06-16T22:53:49.590","status":"Modified","description":"The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-94"],"references":["http://marc.info/?l=bugtraq&m=121915960406986&w=2","http://secunia.com/advisories/30883","http://www.exploit-db.com/exploits/6124","http://www.kb.cert.org/vuls/id/837785","http://www.microsoft.com/technet/security/advisory/955179.mspx"],"products":["microsoft:office_snapshot_viewer_activex"],"source":"nvd","synced_at":"2026-10-19T19:51:11.071189229+00:00"},"epss":{"cve":"CVE-2008-2463","score":0.59004,"percentile":0.99111,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}