CVE-2008-4250: Microsoft Windows Server service RPC path canonicalization buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution in a core Windows service, with KEV listing, near-maximum EPSS, and public exploit code.

What it is

The Server service in multiple Windows versions fails to properly handle path canonicalization, allowing a crafted RPC request to overflow a buffer and execute arbitrary code. This is the MS08-067 flaw, a remotely reachable, unauthenticated code execution bug in a core Windows service that was exploited in the wild by Gimmiv.A in October 2008.

Impact

A remote attacker can execute arbitrary code with the privileges of the Server service, typically SYSTEM, giving full control of the host. No user interaction or prior authentication is required.

Attack surface

Reached over the network through the SMB/RPC interface exposed by the Windows Server service; the CVSS vector shows AV:N/PR:N/UI:N, so no authentication or user interaction is needed. Any host exposing the service to untrusted networks is directly reachable.

Exploitation

CISA added it to KEV with a due date of 2026-06-03, EPSS 30-day probability is 0.98751 (99.9th percentile), and multiple references carry Exploit tags including Exploit-DB entries, so public exploit code and in-the-wild use are established.

What to do

• Apply Microsoft security bulletin MS08-067 for all affected Windows versions; this is the primary fix.
• Disable or block the Server service (SMB/RPC) on hosts that do not require it, and restrict TCP 139/445 at network boundaries.
• Segment legacy Windows 2000, XP, Server 2003, Vista, and Server 2008 systems away from untrusted networks.
• Retire or isolate end-of-life systems where the MS08-067 patch cannot be applied, per CISA BOD 22-01 guidance.
• Monitor for and block inbound SMB/RPC from untrusted sources at the perimeter.

Detection

• Alert on SMB/RPC traffic to TCP 139/445 from unexpected or external sources.
• Hunt for known MS08-067 exploit signatures and anomalous Server service crashes or restarts.
• Review host logs for unexpected SYSTEM-level process creation following SMB connections.
• Inventory unpatched legacy Windows hosts still exposing the Server service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.