Vulnerability record · CVE-2006-3439 · published 9 August 2006
CVE-2006-3439: Microsoft Windows Server Service RPC buffer overflow allows remote code execution
Microsoft · Windows 2000
The Server Service in Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 contains a buffer overflow reachable through a crafted RPC message. Because the service is network-facing and accepts anonymous connections, an unauthenticated remote attacker can trigger the overflow and execute arbitrary code. It is a distinct issue from CVE-2006-1314.
Description
Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 10.0 with network reachability, no authentication and full confidentiality/integrity/availability impact, plus very high EPSS, makes this a top-priority patch despite no KEV listing.
What it is
The Server Service in Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 contains a buffer overflow reachable through a crafted RPC message. Because the service is network-facing and accepts anonymous connections, an unauthenticated remote attacker can trigger the overflow and execute arbitrary code. It is a distinct issue from CVE-2006-1314.
Impact
Successful exploitation gives the attacker arbitrary code execution in the context of the Server Service, typically SYSTEM, leading to full host compromise. No privileges or user interaction are required.
Attack surface
Reached over the network via RPC to the Windows Server Service (SMB/RPC path); the CVSS vector AV:N/AC:L/Au:N confirms no authentication and no user interaction are needed.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.85, ~99.7th percentile), indicating strong likelihood of exploitation activity. Multiple references carry Patch and US Government Resource tags, consistent with a widely targeted, wormable-class flaw.
What to do
- Apply Microsoft security bulletin MS06-040 (the vendor patch referenced in the record) to all affected Windows 2000 SP4, XP SP1/SP2 and Server 2003 SP1 systems.
- Block or restrict inbound SMB/RPC (TCP 139/445 and related RPC ports) at network boundaries and between untrusted segments.
- Disable the Server Service on hosts that do not require file/print sharing.
- Isolate or retire unsupported Windows 2000/XP/2003 SP1 systems that cannot be patched.
- Verify patch deployment with the OVAL definition referenced in the record.
Detection
- Monitor for unexpected crashes or restarts of the Server Service (svchost.exe hosting lanmanserver) on affected hosts.
- Alert on anomalous or malformed RPC/SMB traffic to ports 139/445 from untrusted sources.
- Hunt for suspicious child processes spawned by the Server Service or SYSTEM-level processes following RPC activity.
- Use the OVAL definition org.mitre.oval:def:492 to audit patch state across the estate.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3439 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3439), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
