CVE-2005-1206: Microsoft Windows SMB buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution on a core Windows service with a high EPSS score, though no confirmed active exploitation in this record.

What it is

A buffer overflow exists in the Server Message Block (SMB) implementation on Windows 2000, XP SP1/SP2, and Server 2003/SP1. The specific vectors are not described in the record, but the flaw is remotely reachable and can lead to arbitrary code execution. It matters because SMB is a core network service exposed on many Windows hosts.

Impact

A remote attacker can execute arbitrary code in the context of the vulnerable SMB service, potentially gaining full control of the host. The CVSS 2.0 vector indicates partial confidentiality, integrity, and availability impact.

Attack surface

Reached over the network via SMB (AV:N, AC:L, Au:N), so no authentication or user interaction is required per the vector. The exact SMB request or packet that triggers the overflow is not specified in the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded. EPSS is high (0.70277, 99.35th percentile), and references are patch/vendor advisories rather than exploit write-ups, so active exploitation is not confirmed by this record.

What to do

• Apply the Microsoft MS05-027 security update to all affected Windows 2000, XP, and Server 2003 systems.
• Block or restrict SMB (TCP 445 and 139) at network boundaries and between untrusted segments.
• Disable unnecessary SMB/NetBIOS services and file sharing on hosts that do not require them.
• Segment networks so that SMB is not reachable from untrusted or guest networks.
• Monitor vendor advisories for any updated guidance on this legacy issue.

Detection

• Monitor SMB traffic (TCP 445/139) for anomalous or malformed requests that could indicate overflow attempts.
• Alert on unexpected SMB service crashes or restarts on affected Windows hosts.
• Use host-based detection for suspicious processes spawned by the SMB service (e.g., services.exe or System).
• Review network IDS/IPS signatures for known SMB buffer overflow patterns where available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.