CVE Feed

    Dashboard / CVE / CVE-2009-3103

    CVE-2009-3103

    Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

    Published:Sep 8, 2009
    Last Modified:Apr 23, 2026
    EPS:Sep 8, 2009
    EPSS Score:0.92861
    CVSS Score:10

    Affected Products

    Vendor
    Microsoft
    Product
    Windows Server 2008
    Vendor
    Microsoft
    Product
    Windows Vista

    Exploits

    http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.htmlhttp://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.htmlhttp://www.securityfocus.com/bid/36299http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.htmlhttp://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.htmlhttp://www.securityfocus.com/bid/36299https://www.exploit-db.com/exploits/12524https://github.com/afifudinmtop/CVE-2009-3103https://github.com/nicolasdamians/ms09-050-CVE-2009-3103-exploithttps://github.com/sec13b/ms09-050_CVE-2009-3103https://github.com/Sic4rio/CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-https://github.com/sooklalad/ms09050https://www.exploit-db.com/exploits/10005https://www.exploit-db.com/exploits/14674https://www.exploit-db.com/exploits/16363https://www.exploit-db.com/exploits/40280https://www.exploit-db.com/exploits/9594

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-20936 (CVSS 4.3) — Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attac…
    CVE-2026-20931 (CVSS 8) — External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate pr…
    CVE-2026-20929 (CVSS 7.5) — Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network…
    CVE-2026-20872 (CVSS 6.5) — External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over…
    CVE-2026-20868 (CVSS 8.8) — Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker…
    CVE-2026-20849 (CVSS 7.5) — Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to eleva…
    CVE-2026-20843 (CVSS 7.8) — Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to e…
    CVE-2026-20940 (CVSS 7.8) — Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate …
    CVE-2026-20927 (CVSS 5.3) — Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Ser…
    CVE-2026-20925 (CVSS 6.5) — External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over…

    References

    http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.html
    http://blog.48bits.com/?p=510
    http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html
    http://isc.sans.org/diary.html?storyid=7093
    http://osvdb.org/57799
    http://secunia.com/advisories/36623
    http://www.exploit-db.com/exploits/9594
    http://www.kb.cert.org/vuls/id/135940
    http://www.microsoft.com/technet/security/advisory/975497.mspx
    http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1
    http://www.securityfocus.com/archive/1/506300/100/0/threaded
    http://www.securityfocus.com/archive/1/506327/100/0/threaded
    http://www.securityfocus.com/bid/36299
    http://www.securitytracker.com/id?1022848
    http://www.us-cert.gov/cas/techalerts/TA09-286A.html
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050
    https://exchange.xforce.ibmcloud.com/vulnerabilities/53090
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6489
    http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0090.html
    http://blog.48bits.com/?p=510
    http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html
    http://isc.sans.org/diary.html?storyid=7093
    http://osvdb.org/57799
    http://secunia.com/advisories/36623
    http://www.exploit-db.com/exploits/9594
    http://www.kb.cert.org/vuls/id/135940
    http://www.microsoft.com/technet/security/advisory/975497.mspx
    http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1
    http://www.securityfocus.com/archive/1/506300/100/0/threaded
    http://www.securityfocus.com/archive/1/506327/100/0/threaded
    http://www.securityfocus.com/bid/36299
    http://www.securitytracker.com/id?1022848
    http://www.us-cert.gov/cas/techalerts/TA09-286A.html
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-050
    https://exchange.xforce.ibmcloud.com/vulnerabilities/53090
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6489

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High