CVE-2008-4250
Microsoft Windows: Buffer Overflow
As of , CVE-2008-4250 in Microsoft Windows is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 20 May 2026
- US federal deadline
- 3 June 202614 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- 1 Metasploit module and 6 Exploit-DB entries (5 verified)
- Fix
- Vendor advice: learn.microsoft.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
CISA's description
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
The CVE record's description, from microsoft
- CVE published
- 23 October 2008
- Assigned by
- microsoft
- CVSS
- 9.8 Critical (CVSS 3.1, from CISA-ADP)
- CWE-119
- Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-94
- Improper Control of Generation of Code ('Code Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 6824).
- Exploit-DB published an exploit (EDB-ID 6841).
- Exploit-DB published an exploit (EDB-ID 7104).
- Exploit-DB published an exploit (EDB-ID 7132).
- Exploit-DB published an exploit (EDB-ID 16362).
- Exploit-DB published an exploit (EDB-ID 40279).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: MS08-067 Microsoft Server Service Relative Path Stack Corruptionexploit module, rank great
- Exploit-DB: Microsoft Windows Server - Service Relative Path Stack Corruption (MS08-067) (Metasploit)EDB-ID 16362, verified by Exploit-DB, 21 January 2011
- Exploit-DB: Microsoft Windows Server 2000/2003 - Code Execution (MS08-067)EDB-ID 7132, verified by Exploit-DB, 16 November 2008
- Exploit-DB: Microsoft Windows Server - Code Execution (MS08-067)EDB-ID 7104, verified by Exploit-DB, 12 November 2008
- Exploit-DB: Microsoft Windows Server - Universal Code Execution (MS08-067)EDB-ID 6841, verified by Exploit-DB, 26 October 2008
- Exploit-DB: Microsoft Windows Server - Code Execution (PoC) (MS08-067)EDB-ID 6824, verified by Exploit-DB, 23 October 2008
- Exploit-DB: Microsoft Windows - 'NetAPI32.dll' Code Execution (Python) (MS08-067)EDB-ID 40279, 26 February 2016
Windows: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2025-60710Link Following | Microsoft Windows | Patch nowRansomware use, listed within a year | 0.05 | ||
| CVE-2008-0015Video ActiveX Control Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.77; verified Exploit-DB entry | 0.77 | ||
| CVE-2013-3918Out-of-Bounds Write | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.74; verified Exploit-DB entry | 0.74 | ||
| CVE-2010-2568Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.91; verified Exploit-DB entry | 0.91 | ||
| CVE-2015-0016TS WebProxy Directory Traversal | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.76; verified Exploit-DB entry | 0.76 | ||
| CVE-2015-2426Adobe Type Manager Library Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.87; verified Exploit-DB entry | 0.87 | ||
| CVE-2014-6332Object Linking & Embedding (OLE) Automation Array Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.95; verified Exploit-DB entry | 0.95 | ||
| CVE-2017-0146SMB Remote Code Execution | Microsoft Windows | Patch this weekRansomware use; Metasploit module; EPSS 0.90; verified Exploit-DB entry | 0.90 | ||
| CVE-2014-4114Object Linking & Embedding (OLE) Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.82; verified Exploit-DB entry | 0.82 | ||
| CVE-2014-6352Code Injection | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.77; verified Exploit-DB entry | 0.77 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org