CVE-2008-1446

CVE-2008-1446 is a critical-severity vulnerability in Microsoft Internet Information Services with a CVSS 2.0 base score of 9.0. Its EPSS exploit-prediction score of 46% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-190.

Key facts

• Severity: Critical (CVSS 2.0 base score 9.0)
• EPSS exploit prediction: 46% (99th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-190
• Affected product: Microsoft Internet Information Services
• Published: 2008-10-15
• Last modified: 2026-06-16

Description

Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."

Frequently asked questions

What is CVE-2008-1446?

Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."

How severe is CVE-2008-1446?

CVE-2008-1446 has a CVSS 2.0 base score of 9.0, rated critical severity.

Is CVE-2008-1446 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 46% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-1446?

CVE-2008-1446 affects Microsoft Internet Information Services. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2008-1446?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2008-1446 published?

CVE-2008-1446 was published on 2008-10-15 and last updated on 2026-06-16.

References

• http://marc.info/?l=bugtraq&m=122479227205998&w=2
• http://secunia.com/advisories/32248
• http://www.kb.cert.org/vuls/id/793233
• http://www.securityfocus.com/bid/31682
• http://www.securitytracker.com/id?1021048
• http://www.us-cert.gov/cas/techalerts/TA08-288A.html
• http://www.vupen.com/english/advisories/2008/2813
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-062
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45545
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45548
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5764

Affected products (1)

• cpe:2.3:a:microsoft:internet_information_services:*:*:*:*:*:*:*:*

More vulnerabilities in Microsoft Internet Information Services

• CVE-2010-3972 — Critical (CVSS 10.0): Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0…
• CVE-2008-4301 — Critical (CVSS 10.0): A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set…
• CVE-2007-2815 — Critical (CVSS 10.0): The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0…
• CVE-2003-0224 — Critical (CVSS 10.0): Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute…
• CVE-1999-0233 — Critical (CVSS 10.0): IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.
• CVE-2017-7269 — Critical (CVSS 9.8): Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0…

All CVEs affecting Microsoft Internet Information Services →

Other CWE-190 (Integer Overflow or Wraparound) vulnerabilities

• CVE-2026-4689 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was…
• CVE-2026-24814 — Critical (CVSS 10.0): Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is…
• CVE-2025-64721 — Critical (CVSS 10.0): Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions…
• CVE-2015-5108 — Critical (CVSS 10.0): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC…
• CVE-2015-5097 — Critical (CVSS 10.0): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC…
• CVE-2013-2555 — Critical (CVSS 10.0): Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before…

Browse all CWE-190 (Integer Overflow or Wraparound) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

• 200.71.154.142 (ipv4-addr)
• 131.161.184.46 (ipv4-addr)
• 200.57.190.209 (ipv4-addr)
• 190.111.226.20 (ipv4-addr)