CVE-2008-0015

CVE-2008-0015 is a remote code execution vulnerability in the Microsoft Windows Video ActiveX Control, a browser-hostable component bundled with Windows. It is triggered when a user views a specially crafted web page that instantiates the vulnerable control, which lets the attacker's code run in the context of the logged-on user. A successful attacker gains the same user rights as the victim, so an administrator browsing with elevated rights would face full system compromise; any Windows user who views web content with the control enabled is affected. Per CISA the flaw is being actively exploited (added to the Known Exploited Vulnerabilities catalog on 2026-02-17, ransomware use unknown), and EPSS assigns it a 76.7% probability of exploitation within 30 days, placing it in the top percentile.

What to do: Apply Microsoft's security update for the Windows Video ActiveX Control; as interim mitigation, apply the vendor-documented kill-bit registry keys (including the out-of-band 'Isolated' kill bit Microsoft shipped) so the control cannot be instantiated in Internet Explorer. Because the flaw is on the CISA KEV list, federal agencies must remediate within BOD 22-01 timelines (or apply vendor mitigations for cloud services), and defenders should audit legacy Windows hosts for use of this control, discourage browsing with administrator rights, and prioritize patching systems used for web browsing.