In CISA KEV9.8 Critical
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability
MicrosoftWindows
Status
- Exploited in the wild
- In CISA KEV since 20 May
- Vendor fix available
Federal deadlineWed 3 Jun, 23:59 UTC
Passed 143 days ago
CISA KEV · added 20 May
Exploit probabilityEPSSchecked 24 Oct
99%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 4 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 20 May · 18:02 UTC | CISA | CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs |
| Wed 20 May · 19:31 UTC | CISA | CISA Warns of Active Exploit in Windows RPC Flaw CVE-2008-4250 |
| Wed 20 May · 20:13 UTC | CISA | CISA adds buffer overflow flaw CVE-2008-4250 to KEV catalogue |
| Thu 21 May · 21:32 UTC | Security Affairs | CISA Adds Critical Flaws in Windows, Office, Defender to KEV List |
- CISA Adds Critical Flaws in Windows, Office, Defender to KEV ListSecurity Affairs
- CISA adds buffer overflow flaw CVE-2008-4250 to KEV catalogueCISA · official notice
- CISA Warns of Active Exploit in Windows RPC Flaw CVE-2008-4250CISA · official notice
- CISA adds seven KEV flaws, including 2026 Microsoft Defender bugsCISA · first in our coverage · official notice