CVE-2008-4250criticalunder attackCWE-119

CVE-2008-4250

Published 23 Oct 2008 · Updated 21 May 2026

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.8epss 99%

from disclosure to weapon820 days

Published on NVDOct 23

1st PoC+820d

metasploit+5d

CISA KEV+6418d

Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

CTIR Gov · ALERTA 37/2026Vulnerabilidade crítica no Windowsread on gov.br ↗

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.

Action required by CISAfederal deadline: 2026-06-03

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Windows Server service allows attackers to send specially crafted network requests that crash the server or execute malicious code without needing any credentials. This vulnerability was actively exploited by malware in the wild.

Technical detail

Buffer overflow in the Server service RPC handler during path canonicalization allows unauthenticated remote code execution. The vulnerability requires only network access and a specially crafted RPC request; no authentication or user interaction is necessary. Successful exploitation results in arbitrary code execution with SYSTEM privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 13✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6841 cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6824 cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/7104 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/16362 cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/7132 exploitdbwww.exploit-db.com/exploits/40279unverified githubgithub.com/BinRacer/ms08-067.py★ 3 githubgithub.com/thunderstrike9090/Conflicker_analysis_scripts★ 1 githubgithub.com/NoTrustedx/Exploit_MS08-067★ 1 githubgithub.com/BinRacer/ms08-067★ 0 vulncheckvulncheck.com/xdb/9e9432b22aa1unverified vulncheckvulncheck.com/xdb/05f69632d4ddunverified vulncheckvulncheck.com/xdb/b3a01e4d5e17unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blogs.securiteam.com/index.php/archives/1150 http://marc.info/?l=bugtraq&m=122703006921213&w=2 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 http://secunia.com/advisories/32326 https://exchange.xforce.ibmcloud.com/vulnerabilities/46040 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250 https://www.exploit-db.com/exploits/6824 https://www.exploit-db.com/exploits/6841 https://www.exploit-db.com/exploits/7104 https://www.exploit-db.com/exploits/7132 http://www.kb.cert.org/vuls/id/827267