CVE-2009-0080

no score yetEPSS 2.4%

The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2009-04-15
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

microsoft:windows_server_2008
microsoft:windows_vista

References

http://osvdb.org/53668
http://www.securitytracker.com/id?1022044
http://www.us-cert.gov/cas/techalerts/TA09-104A.html
http://www.vupen.com/english/advisories/2009/1026
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012

Check your stack JSON