AEGLIX vulnerability intelligence
CVE-2008-4250
CRITICAL · CVSS 9.8 · Analyzed
Published: 2008-10-23 · Updated: 2026-06-16 · Source: NVD
Vulnerability overview
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
Severity and scoring
- CVSS score
- 9.8 · CRITICAL
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-119, CWE-94
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Microsoft · Windows
- Added to catalog
- 2026-05-20
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA remediation due date
- 2026-06-03
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:-:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:itanium:*
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:-:*:x86:*
cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:-:*:x64:*
cpe:2.3:o:microsoft:windows_xp:-:-:*:*:professional:*:x64:*
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*
cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://blogs.securiteam.com/index.php/archives/1150
Permissions Required
- http://marc.info/?l=bugtraq&m=122703006921213&w=2
Issue Tracking · Mailing List · Third Party Advisory
- http://secunia.com/advisories/32326
Patch · Vendor Advisory
- http://www.kb.cert.org/vuls/id/827267
Third Party Advisory · US Government Resource
- http://www.securityfocus.com/archive/1/497808/100/0/threaded
Broken Link · Third Party Advisory · VDB Entry
- http://www.securityfocus.com/archive/1/497816/100/0/threaded
Broken Link · Third Party Advisory · VDB Entry
- http://www.securityfocus.com/bid/31874
Broken Link · Exploit · Patch · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id?1021091
Broken Link · Third Party Advisory · VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-297A.html
Broken Link · Third Party Advisory · US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA09-088A.html
Third Party Advisory · US Government Resource
- http://www.vupen.com/english/advisories/2008/2902
Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067
Patch · Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46040
Third Party Advisory · VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093
Broken Link · Third Party Advisory
- https://www.exploit-db.com/exploits/6824
Exploit · Third Party Advisory · VDB Entry
- https://www.exploit-db.com/exploits/6841
Exploit · Third Party Advisory · VDB Entry
- https://www.exploit-db.com/exploits/7104
Exploit · Third Party Advisory · VDB Entry
- https://www.exploit-db.com/exploits/7132
Exploit · Third Party Advisory · VDB Entry
- http://blogs.securiteam.com/index.php/archives/1150
Permissions Required
- http://marc.info/?l=bugtraq&m=122703006921213&w=2
Issue Tracking · Mailing List · Third Party Advisory
- http://secunia.com/advisories/32326
Patch · Vendor Advisory
- http://www.kb.cert.org/vuls/id/827267
Third Party Advisory · US Government Resource
- http://www.securityfocus.com/archive/1/497808/100/0/threaded
Broken Link · Third Party Advisory · VDB Entry
- http://www.securityfocus.com/archive/1/497816/100/0/threaded
Broken Link · Third Party Advisory · VDB Entry
- http://www.securityfocus.com/bid/31874
Broken Link · Exploit · Patch · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id?1021091
Broken Link · Third Party Advisory · VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-297A.html
Broken Link · Third Party Advisory · US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA09-088A.html
Third Party Advisory · US Government Resource
- http://www.vupen.com/english/advisories/2008/2902
Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067
Patch · Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46040
Third Party Advisory · VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093
Broken Link · Third Party Advisory
- https://www.exploit-db.com/exploits/6824
Exploit · Third Party Advisory · VDB Entry
- https://www.exploit-db.com/exploits/6841
Exploit · Third Party Advisory · VDB Entry
- https://www.exploit-db.com/exploits/7104
Exploit · Third Party Advisory · VDB Entry
- https://www.exploit-db.com/exploits/7132
Exploit · Third Party Advisory · VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250
US Government Resource