CVE-2008-3009 in the critical feed json
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properl…
published 2008-12-10 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-2999
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.8%
- EPSS 15.8% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."
Exploit prediction
15.83% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-255 Credentials Management Errors
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2008/ms08-076
vendor-advisory
-
securityfocus.com
/bid/32653
vdb-entry
-
securitytracker.com
/id?1021372
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5942
vdb-entry, signature
-
us-cert.gov
/cas/techalerts/TA08-344A.html
third-party-advisory, us-government-resource
-
secunia.com
/advisories/33058
third-party-advisory
-
vupen.com
/english/advisories/2008/3388
vdb-entry
-
securitytracker.com
/id?1021373
vdb-entry
Sources
- CVE List CVE-2008-3009
- NVD CVE-2008-3009
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.