CVE-2009-1926

CVE-2009-1926 describes a denial-of-service vulnerability affecting various Microsoft Windows operating systems, including Windows 2000, XP, Server 2003, Vista, and Server 2008. Remote attackers can exploit this flaw by initiating a series of TCP sessions with specific characteristics (small or zero receive window size and pending data) that cause connections to remain indefinitely in FIN-WAIT-1 or FIN-WAIT-2 states, leading to a TCP outage. This vulnerability has a CVSS score of 7.8, indicating high severity, as it can be exploited remotely with low attack complexity and results in a complete loss of availability (denial of service). Despite its high severity and EPSS score, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.