CVE-2000-1089: Microsoft Phone Book Service buffer overflow allows command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityThe CVSS 2.0 score is 10.0 with network reachability, no authentication, and full confidentiality, integrity, and availability impact, and public exploit code is referenced.

What it is

The Microsoft Phone Book Service contains a buffer overflow that lets a local user run arbitrary commands. The flaw affects Windows 2000 and Windows NT systems running the service. Because the service is reachable over the network, the overflow can be triggered remotely, making it a serious pre-authentication risk on unpatched hosts.

Impact

An attacker can execute arbitrary commands with the privileges of the Phone Book Service, which typically runs as SYSTEM, leading to full host compromise.

Attack surface

The CVSS vector is AV:N/AC:L/Au:N/C:C/I:C/A:C, indicating the flaw is reachable over the network with no authentication and no user interaction required. The description states local users can exploit it, so both local and remote paths appear possible.

Exploitation

The record is not listed in CISA KEV, but EPSS is 0.74639 (99.5th percentile), and multiple references carry an Exploit tag, indicating public exploit code exists.

What to do

• Apply Microsoft security bulletin MS00-094 or the corresponding patch for Windows 2000 and Windows NT.
• Disable or stop the Phone Book Service if it is not required.
• Block network access to the service at the host firewall or via network segmentation.
• Restrict interactive logon and local user accounts on affected systems.
• Monitor vendor advisories for any updated guidance on the service.

Detection

• Audit hosts for the Phone Book Service running and flag unpatched Windows 2000/NT systems.
• Monitor process creation events for unexpected child processes spawned by the Phone Book Service.
• Watch for network connections to the service port from untrusted sources.
• Review system logs for service crashes or restarts that could indicate exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.