CVE-2005-0045: Windows SMB packet validation flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution over SMB with a high EPSS score, tempered by the age of the affected platforms and the absence of KEV listing or documented exploit tags.

What it is

Windows NT 4.0, 2000, XP and Server 2003 fail to properly validate certain SMB packets, specifically Transaction responses carrying Trans or Trans2 commands. A remote attacker can send a crafted packet, such as a Trans2 FIND_FIRST2 response with an oversized file name length field, to trigger memory corruption. Because SMB is a core network service, this is a serious pre-authentication remote code execution issue on unpatched hosts.

Impact

An attacker gains remote code execution in the context of the vulnerable SMB service, which on these Windows versions typically runs with SYSTEM privileges. That allows full compromise of the host, including data theft, malware installation and use as a pivot point.

Attack surface

Reachable over the network via SMB (TCP 445 or 139); the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing SMB to an untrusted network is exposed.

Exploitation

The record is not listed in CISA KEV and no reference carries an exploit tag, so confirmed in-the-wild exploitation is not established here. EPSS is high (0.70284, 99.35th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Apply the Microsoft security update for MS05-011 on all affected Windows NT 4.0, 2000, XP and Server 2003 systems; this is the primary fix.
• Block inbound SMB (TCP 445 and 139) at network boundaries and between untrusted network segments.
• Restrict SMB access to required hosts only and disable the service where it is not needed.
• Retire or isolate end-of-life platforms such as Windows NT 4.0 and Windows 2000 that can no longer be reliably patched.
• Monitor vendor and CERT/CC advisories (VU#652537, TA05-039A) for any updated guidance.

Detection

• Inspect SMB traffic for malformed or anomalous Trans/Trans2 requests and responses, especially FIND_FIRST2 responses with unusually large file name length fields.
• Alert on SMB connection attempts from unexpected or external source addresses to internal file servers and workstations.
• Review host and SMB service logs for crashes, restarts or unexpected process behavior on systems running the affected Windows versions.
• Use the available OVAL definitions to scan for unpatched SMB implementations across the estate.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.