Background
CVE-2008-0015 is an extremely old vulnerability — originally disclosed in 2008 — that has received renewed attention with CISA’s February 2026 KEV listing, more than 17 years after initial disclosure. This addition represents one of the most striking examples of legacy exploitation in the KEV catalog, indicating that actors are finding and targeting systems that have not received patches from 2008 or 2009.
The vulnerability exists in the Windows Video ActiveX Control (MPEG2TuneRequest), which was a component of older Windows media playback functionality. When a user visits a specially crafted web page in Internet Explorer with the affected ActiveX control enabled, an attacker can execute arbitrary code with the privileges of the logged-on user. The vulnerability’s exploitation does not require any additional interaction beyond page visit.
In 2008, this was a zero-day actively exploited in the wild. Its 2026 KEV listing confirms that unpatched legacy Windows systems — possibly embedded systems, industrial HMIs, or extremely old workstations — remain in production environments and are being actively targeted.
Technical Mechanism
CWE classification was not provided in the NVD entry, but this type of ActiveX vulnerability typically involves a memory corruption flaw (buffer overflow or use-after-free) in the COM object’s method handling. When Internet Explorer instantiates the ActiveX control via a web page and calls a vulnerable method with attacker-controlled parameters, the memory corruption enables arbitrary code execution.
<!-- Malicious web page triggering CVE-2008-0015 (historical PoC concept) -->
<html>
<head><script>
// Instantiate vulnerable ActiveX control
var obj = new ActiveXObject("MPEG2TuneRequest");
// Call vulnerable method with crafted arguments
// causes memory corruption → code execution
obj.VulnerableMethod(malformed_argument);
</script></head>
<body>Loading...</body>
</html>The attacker’s code runs in the context of the logged-on user — on systems where users have administrative rights (common in 2008-era configurations), this translates to full system compromise.
Real-World Exploitation Evidence
CVE-2008-0015 was heavily exploited in 2008-2009 immediately after disclosure. The 2026 CISA KEV listing indicates renewed exploitation against legacy systems. Targets most likely include unpatched legacy Windows XP/Vista/7 systems in industrial environments, embedded kiosks, or air-gapped environments that were last patched years ago. Attackers targeting legacy systems often maintain working exploits for old CVEs as these systems never receive patches, providing a reliable and persistent attack surface.
Impact Assessment
- Code execution with logged-on user’s privileges
- Full system compromise if user has administrative rights (common in legacy configs)
- Exploitation requires only that user visit a malicious web page in Internet Explorer
- Legacy systems typically have fewer security controls, amplifying post-exploitation options
- Potential for lateral movement from compromised legacy systems to modern networks
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| Windows XP / Vista | With affected MPEG2TuneRequest ActiveX | MS09-032 (July 2009 patch) |
| Windows Server 2003/2008 | With affected MPEG2TuneRequest ActiveX | MS09-032 |
| Any legacy Windows with ActiveX | Unpatched systems | Must apply MS09-032 or upgrade OS |
Remediation Steps
- Apply Microsoft Security Bulletin MS09-032 if not already applied (17-year-old patch).
- Strongly recommended: Upgrade legacy Windows systems to a supported OS version.
- Disable the vulnerable ActiveX control via kill bit registry setting.
- Block Internet Explorer from loading MPEG2TuneRequest ActiveX via Group Policy.
- Migrate legacy systems off the network or place behind strict network segmentation.
- Treat any Windows system running pre-Windows 8 as untrustworthy on enterprise networks.
Detection Guidance
Log Sources: Web proxy logs, IDS/IPS, host-based firewall logs.
IOCs: Internet Explorer processes on legacy systems loading MPEG2TuneRequest.dll; unusual child processes spawned from iexplore.exe on legacy Windows; ActiveX kill bit events in Windows event logs.
Sigma rule:
title: Legacy ActiveX MPEG2TuneRequest Load CVE-2008-0015
logsource:
product: windows
category: image_load
detection:
selection:
Image|endswith: '\iexplore.exe'
ImageLoaded|contains: 'MPEG2TuneRequest'
condition: selection
level: criticalTimeline
| Date | Event |
|---|---|
| 2008 | CVE-2008-0015 originally disclosed; zero-day exploitation began |
| 2009-07 | Microsoft releases MS09-032 patch |
| 2026-02-17 | CISA adds to KEV catalog; renewed exploitation against legacy systems confirmed |