CVE-2008-4250
KEVMicrosoft Windows Buffer Overflow Vulnerability
Description
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedOct 23, 2008
Last modifiedJun 16, 2026
Added to KEVMay 20, 2026
Remediation dueJun 3, 2026
References
- blogs.securiteam.com/index.php/archives/1150Permissions Required
- marc.info/?l=bugtraq&m=122703006921213&w=2Issue TrackingMailing List
- secunia.com/advisories/32326PatchVendor Advisory
- kb.cert.org/vuls/id/827267Third Party AdvisoryUS Government Resource
- securityfocus.com/archive/1/497808/100/0/threadedBroken LinkThird Party Advisory
- securityfocus.com/archive/1/497816/100/0/threadedBroken LinkThird Party Advisory
- securityfocus.com/bid/31874Broken LinkExploit
- securitytracker.com/id?1021091Broken LinkThird Party Advisory
- us-cert.gov/cas/techalerts/TA08-297A.htmlBroken LinkThird Party Advisory
- us-cert.gov/cas/techalerts/TA09-088A.htmlThird Party AdvisoryUS Government Resource
- vupen.com/english/advisories/2008/2902Vendor Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067PatchVendor Advisory
0 recent articles mention this CVE
89
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 145 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 98.8% · top 1% of all CVEs
- Weakness
- CWE-94
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.