CVE-2009-2495: microsoft visual_c\#

Vulnerability summary

CVE-2009-2495 is a high (CVSS 7.8) vulnerability in microsoft visual_c\#. EPSS estimates a 34.30% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities.

Timeline

1. 29-07-2009
   PublishedVulnerability first disclosed.
2. 27-05-2026
   Last modifiedVulnerability information updated.

Description

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.