CVE-2009-1123

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Desktop Vulnerability."

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/54940Broken Link
http://secunia.com/advisories/35372Broken Link
http://www.securitytracker.com/id?1022359Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlBroken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1544Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6206Broken Link
http://osvdb.org/54940Broken Link
http://secunia.com/advisories/35372Broken Link
http://www.securitytracker.com/id?1022359Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlBroken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1544Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6206Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1123US Government Resource

Timeline

Published: Jun 10, 2009
Last modified: Jun 16, 2026
Added to CISA KEV: Mar 3, 2022
NVD status: Analyzed

Related CVEs from 2009

CVE-2009-11247.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v CVE-2009-11257.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v CVE-2009-11267.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate the user-mode input associated with CVE-2009-11277.2win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and CVE-2009-11289.3Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f CVE-2009-11299.3Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 CVE-2009-11309.3Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows rem CVE-2009-11319.3Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large a CVE-2009-11329.3Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold, SP1, and SP2 and Server 200 CVE-2009-11339.3Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows CVE-2009-11349.3Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, a CVE-2009-11359.0Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication