CVE-1999-0909: Microsoft Terminal Server

High severity, CVSS 7.5. EPSS: 12% chance of exploitation in the next 30 days.

Multihomed Windows systems allow a remote attacker to bypass IP source routing restrictions via a malformed packet with IP options, aka the "Spoofed Route Pointer" vulnerability.

Affected products

• Microsoft Terminal Server: any version
• Microsoft Windows 95: version 0a only; version 0b only
• Microsoft Windows 98se: any version
• Microsoft Windows Nt: version 4.0 only

Published 1999-09-20. Last modified 2026-06-16.