CVE-2009-1922

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-12 · updated 2026-06-16
Weakness: CWE-264

Description

The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka "MSMQ Null Pointer Vulnerability."

Affected products

Microsoft Windows 2000: all versions
Microsoft Windows Server 2003: all versions
Microsoft Windows Vista: all versions
Microsoft Windows XP Service Pack 3: all versions

References

http://en.securitylab.ru/lab/PT-2008-09
http://osvdb.org/56901
http://secunia.com/advisories/36214
http://www.securityfocus.com/archive/1/505691/100/0/threaded
http://www.securitytracker.com/id?1022714
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-040
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6109
http://en.securitylab.ru/lab/PT-2008-09
http://osvdb.org/56901
http://secunia.com/advisories/36214
http://www.securityfocus.com/archive/1/505691/100/0/threaded

Get alerted when CVE-2009-1922 or the next vulnerability affects your stack