CVE-2006-1314: Microsoft Windows Server Service heap buffer overflow via Mailslot messages

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution in a core Windows service with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

The SRV.SYS driver in the Windows Server Service contains a heap-based buffer overflow reachable through crafted first-class Mailslot messages, which corrupt memory and bypass size restrictions on second-class Mailslot messages. Because the Server Service is remotely reachable and unauthenticated, this is a serious pre-auth remote code execution flaw on unpatched Windows 2000, XP and Server 2003 systems.

Impact

A remote attacker can corrupt heap memory and execute arbitrary code in the context of the affected system, potentially gaining full control of the host.

Attack surface

Reached over the network via the Server Service (SMB/Mailslot handling) with no authentication required, per the AV:N/AC:L/Au:N vector. No user interaction is indicated by the description or vector.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.61175, 99.12th percentile), indicating strong predicted exploitation likelihood; references include vendor and US-CERT advisories but no public exploit tag.

What to do

• Apply Microsoft security bulletin MS06-035 (the vendor patch referenced in the advisory) to all affected Windows 2000 SP4, XP SP1/SP2 and Server 2003 up to SP1 systems.
• Block or restrict inbound SMB and Mailslot-related traffic (TCP 139/445 and associated ports) at network boundaries and host firewalls.
• Disable the Server service or Mailslot functionality on hosts that do not require it.
• Retire or isolate unsupported end-of-life platforms (Windows 2000, XP, early Server 2003) that cannot be patched.
• Monitor vendor and US-CERT advisories for updated guidance on this and related Server Service flaws.

Detection

• Monitor for unexpected crashes or restarts of the SRV.SYS driver or Server service on affected hosts.
• Alert on anomalous SMB/Mailslot traffic patterns, especially crafted first-class Mailslot messages from untrusted sources.
• Review host logs for suspicious process creation or privilege escalation following Server service faults.
• Use network IDS signatures for known Mailslot-based SRV.SYS exploitation attempts where available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.