VULNERABILITY INTELLIGENCE
CVE-2008-1436
CVSS score9 HIGH
EPSS probability36.83%
CISA KEVNot currently listed
Published2008-04-21
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Description
Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.