CVE-2002-0597: Windows 2000 LANMAN service denial of service via malformed SMB data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityRemote unauthenticated availability impact on an end-of-life platform, with public exploit material and high EPSS but no KEV listing or code-execution impact.

What it is

The LANMAN service on Microsoft Windows 2000 can be driven into CPU and memory exhaustion by a stream of malformed data sent to the microsoft-ds port (445). The flaw is a remote, unauthenticated denial of service against a core Windows file-sharing service, so a single host can be knocked offline or degraded without any credentials.

Impact

An attacker can exhaust CPU and memory on the target, degrading or halting the LANMAN/SMB service and potentially the host itself. No data confidentiality or integrity loss is described; the effect is availability only.

Attack surface

Reachable over the network on TCP port 445 (microsoft-ds) with no authentication required, per the AV:N/AC:L/Au:N vector. No user interaction is indicated in the description.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high (0.466, 98.8th percentile) and a reference carries an Exploit tag, indicating public exploit material exists.

What to do

• Apply the Microsoft patch referenced in KB Q320751 and the vendor advisory; this is the primary fix.
• Block or restrict inbound TCP 445 at network boundaries and host firewalls where SMB file sharing is not required.
• Segment legacy Windows 2000 systems from untrusted networks and limit exposure of SMB services.
• Monitor and rate-limit malformed SMB traffic to port 445 at the perimeter.
• Plan migration off Windows 2000, which is long past end of support.

Detection

• Alert on spikes in TCP 445 connection volume or malformed SMB payloads targeting a single host.
• Monitor Windows 2000 hosts for sudden CPU and memory saturation correlated with SMB traffic.
• Review firewall and IDS logs for repeated port 445 probes or anomalous microsoft-ds sessions.
• Track LANMAN/SMB service restarts or unresponsiveness on legacy hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.