CVE-2008-3464: microsoft windows_2003_server
Vulnerability summary
CVE-2008-3464 is a high (CVSS 7.2) vulnerability in microsoft windows_2003_server. EPSS estimates a 4.03% chance of exploitation in the next 30 days, higher than 90.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 15-10-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not properly validate input sent from user mode to the kernel, which allows local users to gain privileges via a crafted application, as demonstrated using crafted pointers and lengths that bypass intended ProbeForRead and ProbeForWrite restrictions, aka "AFD Kernel Overwrite Vulnerability."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.03%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 4.03% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (K-plugin) (MS08-066)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Microsoft1 product
- windows_2003_serverprofessional:sp3
1 vendor · 1 product
References
13 links- blogs.technet.com/swi/…X Refsource MISC
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5825VDB EntrySignatureX Refsource OVAL
Show all 13 references
- www.us-cert.gov/cas/techalerts/TA08-288A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-066Vendor AdvisoryX Refsource MS