The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista ...
CVE-2008-4250 (GitHub advisory GHSA-3v68-r58v-m4c2) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Control of Generation of Code ('Code Injection') (CWE-94). No affected-package or version data has been published, so its fix status is unknown. CISA lists it as a known exploited vulnerability (added 20 May 2026).
Published 23 Oct 2008Updated 21 May 2026
- CVE ID
- CVE-2008-4250
- GHSA ID
- GHSA-3v68-r58v-m4c2
- EPSS
- 98.75%higher than 99.9% of CVEs
- Weaknesses (CWE)
- KEV status
- Known exploitedAdded 20 May 2026
- Published
- 23 Oct 2008
- Updated
- 21 May 2026
- Assigned by (CNA)
- microsoft
Summary
Source: GitHub Advisory Database
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
Technical details
Source: GitHub Advisory Database
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCritical9.8Base score from GitHub Advisory Database
- Attack Vector AV
- Network
- Attack Complexity AC
- Low
- Privileges Required PR
- None
- User Interaction UI
- None
- Scope S
- Unchanged
- Confidentiality C
- High
- Integrity I
- High
- Availability A
- High
CISA SSVC decision points
- Exploitation
- active
- Exploited in the wild
- Automatable
- yes
- Attackers can automate this at scale
- Technical impact
- total
- Full control of the affected system
CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by 3 Jun 2026.
Affected packages
Source: CVE.org
No affected packages have been published. The vendor may describe affected products only in prose (see the summary).
Fix
Source: CVE.org
Fix status unknown
The sources CVEminer reads publish no affected-package or version data for this vulnerability, so it can't tell whether a fix exists. Check the vendor advisory in the references below.
Vulnerability intelligence
Root cause analysis
Vulnerable functions
References
Advisories 8
Reports and issues 2
Exploits and evidence 4
Questions about CVE-2008-4250
- What is the GHSA ID for CVE-2008-4250?
- GitHub tracks CVE-2008-4250 as GHSA-3v68-r58v-m4c2.
- What is the CVSS score of CVE-2008-4250?
- CVE-2008-4250 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- How do I fix CVE-2008-4250?
- No affected-package or version data has been published, so its fix status is unknown.
- Is CVE-2008-4250 exploited in the wild?
- CISA lists it as a known exploited vulnerability (added 20 May 2026). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 98.75% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.
Data sources
Upstream records
- OSV (GitHub advisory)No record
- GitHub Advisory DatabaseLoadedRaw JSON
- OSV (CVE record)No record
- CVE.orgLoaded
- CISA KEV catalogLoaded
Fetched 2 days ago (13 Oct 2026, 13:31 UTC). Records refresh automatically after 24 hours.
Where each part of this page came from
- Title and description
- GitHub Advisory Database
- Severity score
- GitHub Advisory Database
- Weakness (CWE)
- GitHub Advisory Database
- Affected packages
- CVE.org
- Fix
- CVE.org
- References
- Computed by CVEminer
- SSVC
- CVE.org
- KEV status
- CISA KEV catalog
- EPSS
- GitHub Advisory Database
OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.