Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and…
Priority MEDIUM 59CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."
Why it matters now
EPSS 0.1583 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:windows_media_format_runtime:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:windows_media_player:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:windows_media_format_runtime:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Microsoft
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:windows_media_services:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_media_services:9:*:*:*:*:*:*:* | 9 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_media_services:2008:*:*:*:*:*:*:* | 2008 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:*:*:*:*:*:* | 11 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:gold:*:*:*:*:*:*:* | gold | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:x64:*:*:*:*:* | 11 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_media_format_runtime:9.5:*:x64:*:*:*:*:* | 9.5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_media_format_runtime:9.5:*:*:*:*:*:*:* | 9.5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:windows_media_format_runtime:9:*:*:*:*:*:*:* | 9 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:windows_media_services:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_media_services:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_media_services:2008:*:*:*:*:*:*:* Versions 2008 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:gold:*:*:*:*:*:*:* Versions gold Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:windows_media_format_runtime:11:*:x64:*:*:*:*:* Versions 11 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_media_format_runtime:9.5:*:x64:*:*:*:*:* Versions 9.5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_media_format_runtime:9.5:*:*:*:*:*:*:* Versions 9.5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:windows_media_format_runtime:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-3009
- 2026-10-03 Alias added: GHSA-qg3h-7xjj-r5g4
References
More Microsoft Windows Media Format Runtime vulnerabilities
- TI-2007-00060 Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition… CVSS 2.0HIGH 9.3
- TI-2009-00534 Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media… CVSS 2.0HIGH 9.3
- TI-2013-02727 The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime… CVSS 2.0HIGH 9.3
- TI-2009-02411 Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media… CVSS 2.0HIGH 9.3
- TI-2010-01798 Unspecified vulnerability in Quartz.dll for DirectShow; Windows Media Format Runtime 9… CVSS 2.0HIGH 9.3
- TI-2009-02386 Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and Windows Media Services 9.1… CVSS 2.0HIGH 9.3
Sources
- CVE-2008-3009 · CVE Program
- CVE-2008-3009 · NVD
- FIRST EPSS
- GHSA-qg3h-7xjj-r5g4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences