CVE-2008-1440

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 22.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-06-12 · updated 2026-06-16
Weakness: CWE-1284

Description

Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."

Affected products

Microsoft Windows Server 2003: all versions
Microsoft Windows XP Service Pack 3: all versions

References

http://secunia.com/advisories/30587
http://securitytracker.com/id?1020230
http://www.securityfocus.com/bid/29508
http://www.us-cert.gov/cas/techalerts/TA08-162B.html
http://www.vupen.com/english/advisories/2008/1783
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5473
http://secunia.com/advisories/30587
http://securitytracker.com/id?1020230
http://www.securityfocus.com/bid/29508
http://www.us-cert.gov/cas/techalerts/TA08-162B.html
http://www.vupen.com/english/advisories/2008/1783

Get alerted when CVE-2008-1440 or the next vulnerability affects your stack