CVE-2011-1248: Microsoft WINS socket send exception handling allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with a CVSS 2.0 score of 9.3 and very high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

WINS on Windows Server 2003 SP2 and Server 2008 (Gold, SP2, R2, R2 SP1) mishandles socket send exceptions, involving unintended stack-frame values and buffer passing. Crafted packets can corrupt memory, letting a remote attacker execute arbitrary code or crash the service. The flaw is an input validation failure in a network-facing service.

Impact

A remote attacker can run arbitrary code with the privileges of the WINS service, or cause a denial of service through memory corruption.

Attack surface

Reached over the network via crafted packets to the WINS service; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required, though some conditions must be met for exploitation.

Exploitation

Not listed in CISA KEV and no reference tags indicate a public exploit, but EPSS is high at 0.476 (98.8th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Apply Microsoft security bulletin MS11-035 for the affected Windows Server versions.
• Restrict network access to WINS (TCP/UDP 42) to trusted hosts and block it at perimeter boundaries.
• Disable the WINS service on servers that do not require it.
• Segment or retire legacy Windows Server 2003 and 2008 systems where feasible.

Detection

• Monitor WINS service crashes or unexpected restarts in Windows event logs.
• Alert on anomalous or malformed traffic to WINS ports 42/TCP and 42/UDP.
• Watch for unexpected processes spawned by or under the WINS service context.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.