CVE-2009-1923: Microsoft Windows 2000

High severity, CVSS 9.3. EPSS: 24.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted WINS replication packet that triggers an incorrect buffer-length calculation, aka "WINS Heap Overflow Vulnerability."

Affected products

• Microsoft Windows 2000: any version
• Microsoft Windows 2003 Server: affected versions not specified

Published 2009-08-12. Last modified 2026-06-16.