{"schemaVersion":3,"id":"CVE-2009-1123","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft Windows Improper Input Validation Vulnerability","description":"The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka \"Windows Kernel Desktop Vulnerability.\"","dates":{"published":"2009-06-10T18:00:00.000Z","modified":"2025-10-22T00:05:54.609Z","reserved":null,"kevAdded":["2022-03-03T00:00:00.000Z"],"kevDue":["2022-03-24T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.2,"severity":"high","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04878,"percentile":0.92016,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.04878},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04918,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04918,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04918,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04918,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.04878,"percentile":0.92016}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.04878,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.04878,"percentile":0.92016}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-03T00:00:00.000Z","dueDate":"2022-03-24T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Windows Improper Input Validation Vulnerability","description":"The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-1123","label":"nvd.nist.gov/vuln/detail/CVE-2009-1123"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-03T00:00:00.000Z","dueDate":"2022-03-24T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Windows Improper Input Validation Vulnerability","description":"The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2009-1123","label":"nvd.nist.gov/vuln/detail/CVE-2009-1123"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"microsoft","product":"windows_2000","name":"windows 2000","label":"windows_2000","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_2000"},{"vendor":"microsoft","product":"windows_server_2003","name":"windows server 2003","label":"windows_server_2003","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_server_2003"},{"vendor":"microsoft","product":"windows_server_2008","name":"windows server 2008","label":"windows_server_2008","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_server_2008"},{"vendor":"microsoft","product":"windows_vista","name":"windows vista","label":"windows_vista","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_vista"},{"vendor":"microsoft","product":"windows_xp","name":"windows xp","label":"windows_xp","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_xp"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/35372","label":"secunia.com/advisories/35372","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://osvdb.org/54940","label":"osvdb.org/54940","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2009/1544","label":"www.vupen.com/english/advisories/2009/1544","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS","Patch"]},{"url":"http://www.securitytracker.com/id?1022359","label":"www.securitytracker.com/id?1022359","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6206","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6206","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-160A.html","label":"www.us-cert.gov/cas/techalerts/TA09-160A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","Broken Link","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1123","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1123","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-06-10T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft Windows Improper Input Validation Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-03-24T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:54.609Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T16:35:15.493Z","stale":false,"partial":false}}