Microsoft Windows 2000 vulnerabilities

514 CVEs affecting Microsoft Windows 2000, 6 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-6753, published 2012-03-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability, published 2008-10-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 98.8% chance of exploitation in the next 30 days. The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a…
CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability, published 2009-05-29. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 51.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003…
CVE-2010-0232: Microsoft Windows Kernel Exception Handler Vulnerability, published 2010-01-21. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 28.5% chance of exploitation in the next 30 days. The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold…
CVE-2004-0210: Microsoft Windows Privilege Escalation Vulnerability, published 2004-08-06. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 7.2% chance of exploitation in the next 30 days. The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer…
CVE-2002-0367: Microsoft Windows Privilege Escalation Vulnerability, published 2002-06-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 4.9% chance of exploitation in the next 30 days. smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges…
CVE-2009-1123: Microsoft Windows Improper Input Validation Vulnerability, published 2009-06-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 4.9% chance of exploitation in the next 30 days. The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows…
CVE-2003-0352, published 2003-08-18. High severity, CVSS 7.5. EPSS: 98.5% chance of exploitation in the next 30 days. Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by…
CVE-2005-1983, published 2005-08-10. High severity, CVSS 10.0. EPSS: 93% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and…
CVE-2010-0483, published 2010-03-03. High severity, CVSS 7.6. EPSS: 86.6% chance of exploitation in the next 30 days. vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute…
CVE-2001-0241, published 2001-06-27. High severity, CVSS 10.0. EPSS: 85.7% chance of exploitation in the next 30 days. Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0.

Latest

CVE-2007-6753, published 2012-03-28. Medium severity, CVSS 6.2. EPSS: 1.8% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured with a string such as…
CVE-2010-4562, published 2012-02-02. Medium severity, CVSS 4.3. EPSS: 14.3% chance of exploitation in the next 30 days. Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast…
CVE-2010-1255, published 2010-06-08. Medium severity, CVSS 6.8. EPSS: 5.1% chance of exploitation in the next 30 days. The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server 2008 R2 allows local…
CVE-2010-0485, published 2010-06-08. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server 2008 R2 "do not…
CVE-2010-0484, published 2010-06-08. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 "do not properly validate changes in…
CVE-2010-0819, published 2010-06-08. High severity, CVSS 7.2. EPSS: 2.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Windows OpenType Compact Font Format (CFF) driver in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and…
CVE-2010-1690, published 2010-05-07. Medium severity, CVSS 6.4. EPSS: 6.6% chance of exploitation in the next 30 days. The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and…
CVE-2010-1689, published 2010-05-07. Medium severity, CVSS 6.4. EPSS: 6.6% chance of exploitation in the next 30 days. The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and…
CVE-2010-1735, published 2010-05-06. Medium severity, CVSS 4.9. EPSS: 2.5% chance of exploitation in the next 30 days. The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second…
CVE-2010-1734, published 2010-05-06. Medium severity, CVSS 4.9. EPSS: 2.7% chance of exploitation in the next 30 days. The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second…