CVE-2008-1086: Microsoft Internet Explorer

High severity, CVSS 9.3. EPSS: 30.5% chance of exploitation in the next 30 days.

The HxTocCtrl ActiveX control (hxvz.dll), as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and SP2, Vista SP1, and Server 2008, allows remote attackers to execute arbitrary code via malformed arguments, which triggers memory corruption.

Affected products

• Microsoft Internet Explorer: version 5.01 only; version 6 only
• Microsoft Windows-Nt: version 2008 only
• Microsoft Windows 2003 Server: any version
• Microsoft Windows Vista: any version
• Microsoft Windows XP: any version

Published 2008-04-08. Last modified 2026-06-16.