Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

Microsoft Virtual PC/Server lets guest apps gain admin rights

CVE-2009-1542 · published 17 years ago
Summary

Microsoft Virtual PC (2004 SP1, 2007, 2007 SP1) and Virtual Server 2005 R2 SP1 fail to properly check CPU privilege levels. This lets a user inside a virtual machine run specially crafted software that can execute code with full system privileges inside that virtual machine. Apply the latest security updates from Microsoft to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft virtual_pc 2004
2007
cpe:2.3:a:microsoft:virtual_pc:2004:sp1:*:*:*:*:*:*
microsoft virtual_server 2005
cpe:2.3:a:microsoft:virtual_server:2005:r2_sp1:*:*:*:*:*:*
Original advisory text
The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine i...
The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine instructions, which allows guest OS users to execute arbitrary kernel-mode code and gain privileges within the guest OS via a crafted application, aka "Virtual PC and Virtual Server Privileged Instruction Decoding Vulnerability."
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.0 Critical
Exploitation
8% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published15 Jul 2009
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-1542 · NVD
Track software like this
Free during beta