CVE-2008-5416
Description
Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka "SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability."
Official description from the CVE record, published by mitre. Copyright © 1999-2026 The MITRE Corporation. See /security/cve/legal for the CVE license. View the record on cve.org
Key data
EPSS
- Score
- 0.87036 (87.0% probability)
- Percentile
- 99.8%
- Scores of
- Nov 10, 2026
- Model
- v2026.06.15
References
- sec-consult.com/files/20081209_mssql-2000-sp_replwritetovar…
- ADV-2008-3380 (vupen.com)vdb-entry
- 33034 (secunia.com)third-party-advisory
- 50917 (osvdb.org)vdb-entry
- 1021363 (securitytracker.com)vdb-entry
- 7501 (exploit-db.com)exploit
- 1021490 (securitytracker.com)vdb-entry
- mssql-spreplwritetovarbin-bo(47182) (exchange.xforce.ibmcloud.com)vdb-entry
- VU#696644 (kb.cert.org)third-party-advisory
- 20081209 SEC Consult SA-20081109-0 :: Microsoft SQL Server 2000 sp_replwritetovarbin limited memory overwrite vulnerability (securityfocus.com)mailing-list
- 20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite(update to SEC Consult SA-20081209) (securityfocus.com)mailing-list
- MS09-004 (docs.microsoft.com)vendor-advisory
- 4706 (securityreason.com)third-party-advisory
- vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- microsoft.com/technet/security/advisory/961040.mspx
- 32710 (securityfocus.com)vdb-entry
- oval:org.mitre.oval:def:6217 (oval.cisecurity.org)vdb-entrysignature
- vmware.com/security/advisories/VMSA-2011-0003.html
- TA09-041A (us-cert.gov)third-party-advisory
- 20081210 Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite (update to SEC Consult SA-20081209) (archives.neohapsis.com)mailing-list
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX (securityfocus.com)mailing-list
- support.avaya.com/elmodocs2/security/ASA-2009-055.htm
Timeline
- ID reserved
- Record published
- Record last updated
Look up another CVE
About CubePath
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:47 UTC. Sources and licenses