Vulnerability record · CVE-2006-3942 · published 31 July 2006
CVE-2006-3942: Microsoft Windows SMB server driver NULL dereference denial of service
Microsoft · Windows 2000
The Windows server driver srv.sys mishandles an SMB_COM_TRANSACTION message containing a string without null termination, causing a NULL dereference in ExecuteTransaction. A remote, unauthenticated attacker can crash the system, taking down the SMB service and the host.
Description
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityUnauthenticated remote crash of core Windows SMB service with very high EPSS, though no confirmed in-the-wild exploitation or KEV listing.
What it is
The Windows server driver srv.sys mishandles an SMB_COM_TRANSACTION message containing a string without null termination, causing a NULL dereference in ExecuteTransaction. A remote, unauthenticated attacker can crash the system, taking down the SMB service and the host.
Impact
An attacker gains no code execution or data access; the outcome is a full system crash (denial of service). Repeated attempts can keep a target offline.
Attack surface
Reachable over the network via SMB (TCP 445/139) with no authentication or user interaction required, per the AV:N/AC:L/Au:N vector. Any host exposing SMB to untrusted networks is exposed.
Exploitation
Not listed in CISA KEV and no public exploit tags appear in the references, but EPSS is very high (0.75027, 99.5th percentile), indicating elevated predicted exploitation activity.
What to do
- Apply Microsoft security bulletin MS06-063 (the vendor fix for this issue) on all affected Windows NT 4.0, 2000, XP and Server 2003 systems.
- Block inbound SMB (TCP 445 and 139) at network boundaries and between untrusted segments.
- Retire or isolate end-of-life platforms (NT 4.0, 2000, XP) that cannot be patched.
- Restrict SMB exposure to trusted hosts only and monitor for anomalous SMB_COM_TRANSACTION traffic.
Detection
- Monitor for SMB_COM_TRANSACTION requests containing non-null-terminated strings or malformed transaction parameters.
- Alert on unexpected srv.sys crashes or system bugchecks correlated with SMB traffic.
- Baseline and flag unusual SMB session patterns from external or untrusted source addresses.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3942 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3942), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
