$ cve CVE-2009-3103 JSON

CVE-2009-3103 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 92.3% (pctl 100)

Patch early

A public exploit exists.

Description

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	92.35% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-399
On CISA KEV	no
Public exploit	yes
Published	2009-09-08
Last modified	2026-06-16

Affected (2)

Vendor	Product
microsoft	windows server 2008
microsoft	windows vista

Public exploits

Source	Title	Date
exploit-db	Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050)	2016-02-26
exploit-db	Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)	2010-08-17
exploit-db	Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) (Metasploit)	2010-07-03
exploit-db	Microsoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service	2010-05-07
exploit-db	Microsoft Windows 7/2008 R2 - Remote Kernel Crash	2009-11-11
exploit-db	Microsoft Windows Vista/7 - SMB2.0 Negotiate Protocol Request Remote Blue Screen of Death (MS07-063)	2009-09-09

References

→ the Explorer · watch your stack · NVD