CVE-2011-1229

CVE-2011-1229 is a high-severity vulnerability in Microsoft Windows 2003 Server with a CVSS 2.0 base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-476.

Key facts

• Severity: High (CVSS 2.0 base score 7.2)
• EPSS exploit prediction: 1% (71st percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-476
• Affected product: Microsoft Windows 2003 Server
• Published: 2011-04-13
• Last modified: 2026-06-16

Description

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other "Vulnerability Type 2" CVEs listed in MS11-034, aka "Win32k Null Pointer De-reference Vulnerability."

Frequently asked questions

What is CVE-2011-1229?

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other "Vulnerability Type 2" CVEs listed in MS11-034, aka "Win32k Null Pointer De-reference Vulnerability."

How severe is CVE-2011-1229?

CVE-2011-1229 has a CVSS 2.0 base score of 7.2, rated high severity.

Is CVE-2011-1229 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2011-1229?

CVE-2011-1229 primarily affects Microsoft Windows 2003 Server. In total, 45 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2011-1229?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2011-1229 published?

CVE-2011-1229 was published on 2011-04-13 and last updated on 2026-06-16.

References

• http://blogs.technet.com/b/srd/archive/2011/04/12/ms11-034-addressing-vulnerabilities-in-the-win32k-subsystem.aspx
• http://osvdb.org/71735
• http://secunia.com/advisories/44156
• http://support.avaya.com/css/P8/documents/100133352
• http://www.securityfocus.com/bid/47229
• http://www.securitytracker.com/id?1025345
• http://www.us-cert.gov/cas/techalerts/TA11-102A.html
• http://www.vupen.com/english/advisories/2011/0952
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-034
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66411
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12503

Affected products (45)

• cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
• cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
• cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
• cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
• cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:x64:*
• cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:*
• cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:x64:*
• cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
• cpe:2.3:a:avaya:agent_access:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:aura_conferencing_standard_edition:6.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:basic_call_management_system_reporting_desktop:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:call_management_server_supervisor:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:callpilot:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:callvisor_asai_lan:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:communication_server_1000_telephony_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:computer_telephony:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:contact_center_express:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:customer_interaction_express:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:enterprise_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:integrated_management:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:interaction_center:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:ip_agent:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:ip_softphone:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:meeting_exchange:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:messaging_application_server:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:network_reporting:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:octelaccess_server:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:octeldesigner:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:operational_analyst:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:outbound_contact_management:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:speech_access:*:*:*:*:*:*:*:*
• cpe:2.3:a:avaya:unified_communication_center:*:*:*:*:*:*:*:*

More vulnerabilities in Microsoft Windows 2003 Server

• CVE-2011-1868 — Critical (CVSS 10.0): The Distributed File System (DFS) implementation in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not…
• CVE-2011-1268 — Critical (CVSS 10.0): The SMB client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server…
• CVE-2011-0661 — Critical (CVSS 10.0): The SMB Server service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows…
• CVE-2011-0654 — Critical (CVSS 10.0): Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in…
• CVE-2010-2550 — Critical (CVSS 10.0): The SMB Server in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server…
• CVE-2010-0476 — Critical (CVSS 10.0): The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2…

All CVEs affecting Microsoft Windows 2003 Server →

Other CWE-476 (NULL Pointer Dereference) vulnerabilities

• CVE-2022-36648 — Critical (CVSS 10.0): The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier,…
• CVE-2020-14500 — Critical (CVSS 10.0): Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.
• CVE-2010-2495 — Critical (CVSS 10.0): The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel before 2.6.34 does…
• CVE-2026-46195 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building…
• CVE-2026-31657 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by…
• CVE-2026-31436 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor…

Browse all CWE-476 (NULL Pointer Dereference) vulnerabilities →