CVE-2008-1446
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet...
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
- Record
CVE-2008-1446- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
- Record
CVE-2008-1446- Updated
- 2026-11-02
EUVDEUVD-2008-1450 No score
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
- Record
EUVD-2008-1450- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w9v9-w8qx-wg82 No score
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet...
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
- Record
GHSA-w9v9-w8qx-wg82- Weakness
- CWE-190
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1446 is a high vulnerability (CVSS 9.0) in Microsoft Internet Information Services, published October 15, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 46.3%, the 98th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2008/2813
kb.cert.org/vuls/id/793233
marc.info?l=bugtraq&m=122479227205998&w=2
exchange.xforce.ibmcloud.com/vulnerabilities/45545
securitytracker.com/id?1021048
secunia.com/advisories/32248
Show 7 moreShow less
us-cert.gov/cas/techalerts/TA08-288A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-062
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5764
securityfocus.com/bid/31682
nvd.nist.gov/vuln/detail/CVE-2008-1446
github.com/advisories/GHSA-w9v9-w8qx-wg82