What is the CVSS score of CVE-2008-1084?

CVE-2008-1084 has a CVSS 2.0 base score of 7.2 (High). CVSS vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 10.4%.

Which versions of Microsoft are affected by CVE-2008-1084?

CVE-2008-1084 presents moderate security risk, a code injection vulnerability rated CVSS 7.2.

Is there a public PoC exploit available for CVE-2008-1084?

Yes, a public proof-of-concept exploit is available for CVE-2008-1084. Prioritise patching immediately. EPSS: 10.4%.

How to fix or mitigate CVE-2008-1084?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Microsoft CVE-2008-1084

HIGH

Code Injection (CWE-94)

2008-04-08 secure@microsoft.com

Code Injection Microsoft RCE

7.2

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:L/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 01:05 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:17 vuln.today

PoC Detected

Apr 09, 2025 - 00:30 vuln.today

Public exploit code

CVE Published

Apr 08, 2008 - 23:05 nvd

HIGH 7.2

DescriptionCVE.org

Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP1, and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation. NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.

AnalysisAI

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Code Injection (CWE-94).

RemediationAI

Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.

CVE-2008-1084 vulnerability details – vuln.today

Back