---
title: "CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability"
url: https://erroneo.us/security/cve/CVE-2008-4250/
description: "CVE-2008-4250 (Microsoft Windows): Exploited in the wild (CISA KEV). The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and…"
type: vulnerability-record
section: "Security Digest"
date_published: 2008-10-23
date_modified: 2026-05-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2008-4250"
kev: true
cvss: 9.8
epss: 0.98751
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Microsoft Windows. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-05-20, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-06-03 ; treat that as the outer limit, not the target.
- EPSS 98.8% , percentile 99.9: FIRST’s model estimates a 98.8% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.

## What it is

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

## Affected products (CVE record)

- n/a n/a: see advisory

## Severity

- CISA-ADP CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2026-05-20; federal due date 2026-06-03. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 98.75% probability of exploitation activity in the next 30 days; percentile 99.9.

## Sources

- [SSRT080164](http://marc.info/?l=bugtraq&m=122703006921213&w=2)
- [MS08-067](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067)
- [Listed in CISA KEV notes (learn.microsoft.com)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067)
- [CVE.org record CVE-2008-4250](https://www.cve.org/CVERecord?id=CVE-2008-4250)
- [NVD entry CVE-2008-4250](https://nvd.nist.gov/vuln/detail/CVE-2008-4250)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250)
- [32326](http://secunia.com/advisories/32326)
- [VU#827267](http://www.kb.cert.org/vuls/id/827267)
- [1021091](http://www.securitytracker.com/id?1021091)
- [7132](https://www.exploit-db.com/exploits/7132)
- [6841](https://www.exploit-db.com/exploits/6841)
- [31874](http://www.securityfocus.com/bid/31874)
- [blogs.securiteam.com](http://blogs.securiteam.com/index.php/archives/1150)
- [6824](https://www.exploit-db.com/exploits/6824)
- [ADV-2008-2902](http://www.vupen.com/english/advisories/2008/2902)
- [win-server-rpc-code-execution(46040)](https://exchange.xforce.ibmcloud.com/vulnerabilities/46040)
- [20081026 Windows RPC MS08-067 FAQ document released](http://www.securityfocus.com/archive/1/497808/100/0/threaded)
- [TA08-297A](http://www.us-cert.gov/cas/techalerts/TA08-297A.html)
- [7104](https://www.exploit-db.com/exploits/7104)
- [TA09-088A](http://www.us-cert.gov/cas/techalerts/TA09-088A.html)
- [oval:org.mitre.oval:def:6093](https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093)
- [20081027 Windows RPC MS08-067 FAQ document updated](http://www.securityfocus.com/archive/1/497816/100/0/threaded)

---
Source page: https://erroneo.us/security/cve/CVE-2008-4250/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt