IPv6 was introduced in XP, so it's probably safe to assume vulnerability there as well. They don't provide updates pre-2008 anyway, so we'll never know until a PoC comes out for testing. Disable IPv6 just in case you do have one of those antiques connected to a network.