CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability

Vulnerability summary

CVE-2008-4250 is a high (CVSS 10.0) Code Injection vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 20-05-2026. EPSS estimates a 98.75% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 8 public exploits are recorded.

Timeline

1. 23-10-2008
   PublishedVulnerability first disclosed.
2. 20-05-2026
   Added to CISA KEVMicrosoft Windows Buffer Overflow Vulnerability
3. 21-05-2026
   Last modifiedVulnerability information updated.
4. 03-06-2026
   CISA remediation dueApply mitigations per vendor instructions.

Description

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.