Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Windows can freeze or crash from specially crafted network request

CVE-2014-0316 · published 12 years ago
Summary

Certain versions of Windows (7, 8, 8.1, Server 2008 R2, Server 2012, and RT) have a problem where the system uses too much memory when it receives a malformed request over the local network. This can cause the computer to become unresponsive or restart, and it also weakens a security feature that normally randomizes memory locations. Apply the latest security updates from Microsoft to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_7 All versions
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
microsoft windows_8 All versions
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
microsoft windows_8.1 All versions
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
microsoft windows_rt All versions
cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
microsoft windows_rt_8.1 All versions
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
microsoft windows_server_2008 r2
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
microsoft windows_server_2012 r2
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
Original advisory text
Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8....
Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (memory consumption) and bypass the ASLR protection mechanism via a crafted client that sends messages with an invalid data view, aka "LRPC ASLR Bypass Vulnerability."
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
11% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published12 Aug 2014
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-0316 · NVD
Track software like this
Free during beta