CVE-2008-1084

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-04-08 · updated 2026-06-16
Weakness: CWE-94

Description

Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP1, and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation. NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.

Affected products

Microsoft Windows 2000: all versions
Microsoft Windows 2003 Server: all versions
Microsoft Windows Server 2008: all versions
Microsoft Windows Vista: all versions
Microsoft Windows XP Service Pack 3: all versions

References

http://marc.info/?l=bugtraq&m=120845064910729&w=2
http://milw0rm.com/sploits/2008-ms08-25-exploit.zip
http://secunia.com/advisories/29720
http://www.securityfocus.com/bid/28554
http://www.securitytracker.com/id?1019803
http://www.us-cert.gov/cas/techalerts/TA08-099A.html
http://www.vupen.com/english/advisories/2008/1149/references
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-025
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5437
https://www.exploit-db.com/exploits/5518
http://marc.info/?l=bugtraq&m=120845064910729&w=2
http://milw0rm.com/sploits/2008-ms08-25-exploit.zip

Get alerted when CVE-2008-1084 or the next vulnerability affects your stack