CVE-2008-4834

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 45.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-14 · updated 2026-06-16
Weakness: CWE-119

Description

Buffer overflow in SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via malformed values of unspecified "fields inside the SMB packets" in an NT Trans request, aka "SMB Buffer Overflow Remote Code Execution Vulnerability."

Affected products

Microsoft Windows 2000: all versions
Microsoft Windows Server 2003: all versions
Microsoft Windows Server 2008: all versions
Microsoft Windows Vista: all versions
Microsoft Windows XP Service Pack 3: all versions

References

http://www.securityfocus.com/archive/1/500012/100/0/threaded
http://www.securityfocus.com/bid/33121
http://www.securitytracker.com/id?1021560
http://www.us-cert.gov/cas/techalerts/TA09-013A.html
http://www.vupen.com/english/advisories/2009/0116
http://www.zerodayinitiative.com/advisories/ZDI-09-001/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-001
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5863
http://www.securityfocus.com/archive/1/500012/100/0/threaded
http://www.securityfocus.com/bid/33121
http://www.securitytracker.com/id?1021560
http://www.us-cert.gov/cas/techalerts/TA09-013A.html

Get alerted when CVE-2008-4834 or the next vulnerability affects your stack