Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2008-4250 Details

Description

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250	CISA-ADP	US Government Resource
http://blogs.securiteam.com/index.php/archives/1150	CVE	Permissions Required
http://marc.info/?l=bugtraq&m=122703006921213&w=2	CVE	Issue TrackingMailing ListThird Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067	CVE	PatchVendor Advisory
http://secunia.com/advisories/32326	CVE	PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46040	CVE	Third Party AdvisoryVDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093	CVE	Broken LinkThird Party Advisory
https://www.exploit-db.com/exploits/6824	CVE	ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/6841	CVE	ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/7104	CVE	ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/7132	CVE	ExploitThird Party AdvisoryVDB Entry
http://www.kb.cert.org/vuls/id/827267	CVE	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/archive/1/497808/100/0/threaded	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/497816/100/0/threaded	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/31874	CVE	Broken LinkExploitPatchThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1021091	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-297A.html	CVE	Broken LinkThird Party AdvisoryUS Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-088A.html	CVE	Third Party AdvisoryUS Government Resource
http://www.vupen.com/english/advisories/2008/2902	CVE	Vendor Advisory
http://blogs.securiteam.com/index.php/archives/1150	[email protected]	Permissions Required
http://marc.info/?l=bugtraq&m=122703006921213&w=2	[email protected]	Issue TrackingMailing ListThird Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/32326	[email protected]	PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46040	[email protected]	Third Party AdvisoryVDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093	[email protected]	Broken LinkThird Party Advisory
https://www.exploit-db.com/exploits/6824	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/6841	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/7104	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/7132	[email protected]	ExploitThird Party AdvisoryVDB Entry
http://www.kb.cert.org/vuls/id/827267	[email protected]	Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/archive/1/497808/100/0/threaded	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/497816/100/0/threaded	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/31874	[email protected]	Broken LinkExploitPatchThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1021091	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-297A.html	[email protected]	Broken LinkThird Party AdvisoryUS Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-088A.html	[email protected]	Third Party AdvisoryUS Government Resource
http://www.vupen.com/english/advisories/2008/2902	[email protected]	Vendor Advisory

see all 37 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
Microsoft Windows Buffer Overflow Vulnerability	May 20, 2026	Jun 3, 2026	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	CISA-ADP

Affected Products

Product	Versions
microsoft windows 2000	All versions
CPE cpe:2.3:o:microsoft:windows_2000:-:sp4:::::: Remediation No remediation found in references.
microsoft windows server 2003	All versions
CPE cpe:2.3:o:microsoft:windows_server_2003:-::::::x64: cpe:2.3:o:microsoft:windows_server_2003:-:sp1:::::: cpe:2.3:o:microsoft:windows_server_2003:-:sp1:::-::itanium: cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::: cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::itanium:* cpe:2.3:o:microsoft:windows_server_2003:-:sp2:::::x64:* Remediation No remediation found in references.
microsoft windows server 2008	All versions
CPE cpe:2.3:o:microsoft:windows_server_2008:-::::-::itanium:* cpe:2.3:o:microsoft:windows_server_2008:-::::-::x64:* cpe:2.3:o:microsoft:windows_server_2008:-::::-::x86:* Remediation No remediation found in references.
microsoft windows vista	All versions
CPE cpe:2.3:o:microsoft:windows_vista:-:::::::* cpe:2.3:o:microsoft:windows_vista:-::::::x64: cpe:2.3:o:microsoft:windows_vista:-:sp1:::::: cpe:2.3:o:microsoft:windows_vista:-:sp1:::-::x64: Remediation No remediation found in references.
microsoft windows xp	All versions
CPE cpe:2.3:o:microsoft:windows_xp:-:-:::professional::x64: cpe:2.3:o:microsoft:windows_xp:-:sp2:::::: cpe:2.3:o:microsoft:windows_xp:-:sp2:::professional::x64: cpe:2.3:o:microsoft:windows_xp:-:sp3:::::: Remediation No remediation found in references.

Change History

17 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Jun 16, 2026	CVE Modified	CISA-ADP
May 21, 2026	Modified Analysis	[email protected]
May 20, 2026	CVE CISA KEV Update	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 20, 2026	CVE Modified	CISA-ADP
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 9, 2022	Modified Analysis	[email protected]
Feb 26, 2019	CPE Deprecation Remap	[email protected]
Feb 26, 2019	CPE Deprecation Remap	[email protected]
Feb 26, 2019	CPE Deprecation Remap	[email protected]
Oct 12, 2018	CVE Modified	[email protected]
Oct 11, 2018	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Aug 8, 2017	CVE Modified	[email protected]
Oct 24, 2008	Initial Analysis	[email protected]

CVE-2008-4250 Details

Description

Metrics

References to Advisories, Solutions, and Tools

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO