High 10.0Published Oct 10, 2008

CVE-2008-4211Integer signedness error in (1) QuickLook in Apple Mac OS X 10.5.5 and (2) Office Viewer in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows remote attackers to cau…

Updated under an hour ago (Nov 2, 2026, 12:20 AM ET)

Does this affect you?

It affects apple mac_os_x and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for apple mac_os_x Exploited in the last 30 days

Integer signedness error in (1) QuickLook in Apple Mac OS X 10.5.5 and (2) Office Viewer in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted Microsoft Excel file that triggers an out-of-bounds memory access, related to "handling of columns."

CVSS: 10.0 HIGH (v2.0, NVD)AV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness (CWE): CWE-189
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

apple mac_os_x apple:mac_os_x	10.5.5	NVD
apple mac_os_x_server apple:mac_os_x_server	10.5.5	NVD
apple iphone_os apple:iphone_os	1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; and 13 more ranges	NVD

References

References

http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	vendor-advisory
http://secunia.com/advisories/32222	vendor-advisory
http://secunia.com/advisories/32756	vendor-advisory
http://support.apple.com/kb/HT3216
http://support.apple.com/kb/HT3318
http://www.securityfocus.com/bid/31681	patch
http://www.securityfocus.com/bid/31707
http://www.securitytracker.com/id?1021027
http://www.vupen.com/english/advisories/2008/2780	vendor-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.