CVE-2009-0080
The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."
Key facts
- CVSS score
- 6.9 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:L/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-269
- EPSS score
- 2.4% (83th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-0089)
- Published
- April 15, 2009
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-0089 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / windows server 2008
- microsoft / windows vista
- microsoft / windows vista
- microsoft / windows vista
- microsoft / windows vista
Certified products that may be affected
17 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Microsoft Windows Server 2008 R2 Hyper-V Release 6.1.7600 - Microsoft Corporation - Common Criteria BSI-DSZ-CC-0755-2012 - archived
- Microsoft Windows 7, Microsoft Windows Server 2008 R2 - Microsoft Corporation - Common Criteria CCEVS-VR-10390-2010 - archived
- Windows Server 2008 R2 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1339 - historical
- Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) - Microsoft Corporation - FIPS 140 1337 - historical
- Microsoft Windows Server 2008 R2 Kernel Mode Cryptographic Primitives Library (cng.sys) - Microsoft Corporation - FIPS 140 1335 - historical
See all 17 in the Security Certifications Explorer.
References
- http://osvdb.org/53668(Broken Link)
- http://www.securitytracker.com/id?1022044(Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA09-104A.html(Third Party Advisory, US Government Resource)
- http://www.vupen.com/english/advisories/2009/1026(Permissions Required)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6177(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain