CVE-2009-1544

HIGH

Windows XP SP2/SP3, Server 2003 SP2, Vista, Server 2008 - Authenticated Use-After-Free via Workstation Service RPC

Title source: llm
STIX 2.1

Description

Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3 or Server 2003 SP2 system, or cause a denial of service via a crafted RPC message to a Vista Gold, SP1, or SP2 or Server 2008 Gold or SP2 system, aka "Workstation Service Memory Corruption Vulnerability."

References (3)

Core 3
Core References
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6286

Scores

CVSS v3 8.8
EPSS 0.2064
EPSS Percentile 97.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-399 CWE-415
Status published
Products (4)
microsoft/windows_2003_server sp2 (3 CPE variants)
microsoft/windows_server_2008 (6 CPE variants)
microsoft/windows_vista (3 CPE variants)
microsoft/windows_xp (3 CPE variants)
Published Aug 12, 2009
Tracked Since Feb 18, 2026