CVE-2007-3463: Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) com...

Security readout for executives and security teams

This CVE describes a local denial-of-service weakness in Microsoft Windows XP SP2. A user on the same machine may be able to terminate processes running under another user’s RunAs-created session. It is not described as remote code execution or privilege escalation, and the vendor reportedly disputed treating RunAs as a security boundary. Exposure appears limited to legacy Microsoft Windows XP SP2 systems where multiple local users share a machine and privileged or separate-account work is performed through RunAs sessions. The provided affected-product metadata is incomplete, listing no CPEs or version ranges beyond the description text. Treat this as a legacy endpoint hardening issue, not an emergency internet-facing vulnerability. Priority rises if Windows XP SP2 remains in production, especially on shared workstations or systems supporting operations where process termination could interrupt business activity. Mitigation focus: Do not rely on RunAs as a security boundary on affected systems.; Use full logoff and logon for separate-account security guarantees.; Restrict local interactive access on legacy Windows XP SP2 systems..

Prepared

Jun 29, 2026, 04:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.