Microsoft Windows XP vulnerabilities

738 CVEs affecting Microsoft Windows XP, 13 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-5364, published 2020-02-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-4250: Microsoft Windows Buffer Overflow Vulnerability, published 2008-10-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 98.8% chance of exploitation in the next 30 days. The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a…
CVE-2010-2568: Microsoft Windows Remote Code Execution Vulnerability, published 2010-07-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-09-15. EPSS: 91.3% chance of exploitation in the next 30 days. Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1)…
CVE-2012-0151: Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability, published 2012-04-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 87.7% chance of exploitation in the next 30 days. The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and…
CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability, published 2011-11-04. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server…
CVE-2008-0015: Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability, published 2009-07-07. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-02-17. EPSS: 76.6% chance of exploitation in the next 30 days. Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in…
CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability, published 2013-11-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 73.7% chance of exploitation in the next 30 days. The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7…
CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability, published 2009-05-29. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 51.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003…
CVE-2013-3660: Microsoft Win32k Privilege Escalation Vulnerability, published 2013-05-24. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 39.3% chance of exploitation in the next 30 days. The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,…
CVE-2013-5065: Microsoft Windows Kernel Privilege Escalation Vulnerability, published 2013-11-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 34.7% chance of exploitation in the next 30 days. NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
CVE-2011-2005: Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability, published 2011-10-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 31.8% chance of exploitation in the next 30 days. afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain…

Latest

CVE-2012-5364, published 2020-02-20. High severity, CVSS 7.5. EPSS: 14.5% chance of exploitation in the next 30 days. The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
CVE-2012-5362, published 2020-02-20. High severity, CVSS 7.5. EPSS: 14.5% chance of exploitation in the next 30 days. The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than…
CVE-2019-1489, published 2019-12-10. High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop Protocol Information Disclosure…
CVE-2017-0176, published 2017-06-22. High severity, CVSS 8.1. EPSS: 45.8% chance of exploitation in the next 30 days. A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target…
CVE-2017-8487, published 2017-06-15. High severity, CVSS 7.8. EPSS: 54.1% chance of exploitation in the next 30 days. Windows OLE in Windows XP and Windows Server 2003 allows an attacker to execute code when a victim opens a specially crafted file or program aka "Windows olecnv32.dll Remote Code Execution…
CVE-2017-8461, published 2017-06-15. High severity, CVSS 7.8. EPSS: 20.4% chance of exploitation in the next 30 days. Windows RPC with Routing and Remote Access enabled in Windows XP and Windows Server 2003 allows an attacker to execute code on a targeted RPC server which has Routing and Remote Access enabled via a…
CVE-2014-4971, published 2014-07-26. High severity, CVSS 7.2. EPSS: 23% chance of exploitation in the next 30 days. Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a…
CVE-2014-0315, published 2014-04-08. Medium severity, CVSS 6.9. EPSS: 14.6% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows…
CVE-2014-0323, published 2014-03-12. Medium severity, CVSS 6.6. EPSS: 2.9% chance of exploitation in the next 30 days. win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,…
CVE-2014-0317, published 2014-03-12. Medium severity, CVSS 5.4. EPSS: 10.4% chance of exploitation in the next 30 days. The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows…