{"schemaVersion":3,"id":"CVE-2008-4250","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft Windows Buffer Overflow Vulnerability","description":"The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka \"Server Service Vulnerability.\"","dates":{"published":"2008-10-23T21:00:00.000Z","modified":"2026-05-21T03:55:20.953Z","reserved":null,"kevAdded":["2026-05-20T00:00:00.000Z"],"kevDue":["2026-06-03T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.98751,"percentile":0.99926,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.98751},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.98751,"percentile":0.99926}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.98751,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.98751,"percentile":0.99926}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2026-05-20T00:00:00.000Z","dueDate":"2026-06-03T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Microsoft Windows Buffer Overflow Vulnerability","description":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.","notes":[{"type":"url","href":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","label":"learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2008-4250","label":"nvd.nist.gov/vuln/detail/CVE-2008-4250"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2026-05-20T00:00:00.000Z","dueDate":"2026-06-03T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Microsoft Windows Buffer Overflow Vulnerability","description":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.","notes":[{"type":"url","href":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","label":"learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2008-4250","label":"nvd.nist.gov/vuln/detail/CVE-2008-4250"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_DE08CD1F74FAC323","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/31874","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"6824","name":"Microsoft Windows Server - Code Execution (PoC) (MS08-067)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/6824","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":"dos","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"dos","platform":"windows","file":"exploits/windows/dos/6824.txt","codes":["OSVDB-49243","CVE-2008-4250","MS08-067"]},"metasploit":null},{"id":"40279","name":"Microsoft Windows - 'NetAPI32.dll' Code Execution (Python) (MS08-067)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/40279","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"windows","file":"exploits/windows/remote/40279.py","codes":["CVE-2008-4250","MS08-067"]},"metasploit":null},{"id":"7104","name":"Microsoft Windows Server - Code Execution (MS08-067)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/7104","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/7104.c","codes":["OSVDB-49243","CVE-2008-4250","MS08-067"]},"metasploit":null},{"id":"16362","name":"Microsoft Windows Server - Service Relative Path Stack Corruption (MS08-067) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16362","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16362.rb","codes":["CVE-2008-4250","OSVDB-49243","MS08-067"]},"metasploit":null},{"id":"6841","name":"Microsoft Windows Server - Universal Code Execution (MS08-067)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/6841","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/6841.txt","codes":["CVE-2008-4250","MS08-067"]},"metasploit":null},{"id":"7132","name":"Microsoft Windows Server 2000/2003 - Code Execution (MS08-067)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/7132","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/7132.py","codes":["OSVDB-49243","CVE-2008-4250","MS08-067"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_SMB_MS08_067_NETAPI","name":"MS08-067 Microsoft Server Service Relative Path Stack Corruption","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/smb/ms08_067_netapi.rb","maturity":"weaponized","reliabilityScore":0.8333333333333334,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/smb/ms08_067_netapi","rank":"500","rankName":"great","postAuth":false,"check":true,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":8,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":"windows_2000","name":"windows 2000","label":"windows_2000","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_2000"},{"vendor":"microsoft","product":"windows_server_2003","name":"windows server 2003","label":"windows_server_2003","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_server_2003"},{"vendor":"microsoft","product":"windows_server_2008","name":"windows server 2008","label":"windows_server_2008","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_server_2008"},{"vendor":"microsoft","product":"windows_vista","name":"windows vista","label":"windows_vista","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_vista"},{"vendor":"microsoft","product":"windows_xp","name":"windows xp","label":"windows_xp","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_xp"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://marc.info/?l=bugtraq&m=122703006921213&w=2","label":"marc.info?l=bugtraq&m=122703006921213&w=2","hostname":"marc.info","tags":["Vendor Advisory","X Refsource HP","Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32326","label":"secunia.com/advisories/32326","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/827267","label":"www.kb.cert.org/vuls/id/827267","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.securitytracker.com/id?1021091","label":"www.securitytracker.com/id?1021091","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/7132","label":"www.exploit-db.com/exploits/7132","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/6841","label":"www.exploit-db.com/exploits/6841","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/31874","label":"www.securityfocus.com/bid/31874","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Exploit","Patch","Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS","Patch"]},{"url":"http://blogs.securiteam.com/index.php/archives/1150","label":"blogs.securiteam.com/index.php/archives/1150","hostname":"blogs.securiteam.com","tags":["X Refsource MISC","Permissions Required"]},{"url":"https://www.exploit-db.com/exploits/6824","label":"www.exploit-db.com/exploits/6824","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2008/2902","label":"www.vupen.com/english/advisories/2008/2902","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46040","label":"exchange.xforce.ibmcloud.com/vulnerabilities/46040","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/497808/100/0/threaded","label":"www.securityfocus.com/archive/1/497808/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-297A.html","label":"www.us-cert.gov/cas/techalerts/TA08-297A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","Broken Link","US Government Resource"]},{"url":"https://www.exploit-db.com/exploits/7104","label":"www.exploit-db.com/exploits/7104","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-088A.html","label":"www.us-cert.gov/cas/techalerts/TA09-088A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/497816/100/0/threaded","label":"www.securityfocus.com/archive/1/497816/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-10-23T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2026-05-20T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft Windows Buffer Overflow Vulnerability","source":"cisa"},{"kind":"modified","date":"2026-05-21T03:55:20.953Z","label":"Last modified","detail":"Vulnerability information updated.","source":null},{"kind":"kev-due","date":"2026-06-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:03:11.834Z","stale":false,"partial":false}}