Vulnerability record · CVE-2008-4114 · published 16 September 2008
CVE-2008-4114: Microsoft Windows SMB srv.sys buffer validation denial of service
Microsoft · Windows 2000
The Server service driver srv.sys in multiple Windows versions fails to validate the buffer size in SMB WRITE_ANDX packets, allowing a remote attacker to crash the system. The flaw is reachable over the network without authentication and was demonstrated against the \PIPE\lsarpc named pipe.
Description
srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via an SMB WRITE_ANDX packet with an offset that is inconsistent with the packet size, related to "insufficiently validating the buffer size," as demonstrated by a request to the \PIPE\lsarpc named pipe, aka "SMB Validation Denial of Service Vulnerability."
AV:N/AC:M/Au:N/C:N/I:N/A:C
Automated analysis
high priorityUnauthenticated remote denial of service with public exploit code and very high EPSS probability, though impact is limited to availability.
What it is
The Server service driver srv.sys in multiple Windows versions fails to validate the buffer size in SMB WRITE_ANDX packets, allowing a remote attacker to crash the system. The flaw is reachable over the network without authentication and was demonstrated against the \PIPE\lsarpc named pipe.
Impact
An unauthenticated remote attacker can cause a full system crash (denial of service). The description also notes a possible unspecified other impact, but no code execution is confirmed.
Attack surface
Reached over the network via SMB by sending a crafted WRITE_ANDX packet with an offset inconsistent with the packet size. No authentication or user interaction is required per the CVSS vector (AV:N/AC:M/Au:N).
Exploitation
Public exploit code is referenced (Exploit tags on multiple references, including Exploit-DB 6463), and EPSS shows a 30-day probability of 0.49275 (98.8th percentile). The CVE is not listed in CISA KEV.
What to do
- Apply Microsoft security bulletin MS09-001, which addresses this SMB validation flaw.
- Block or restrict SMB (TCP 445/139) from untrusted networks at the perimeter and between segments.
- Disable the Server service or SMB where it is not required on affected hosts.
- Retire or isolate unsupported Windows 2000, XP, Server 2003, Vista and Server 2008 systems that cannot be patched.
Detection
- Monitor SMB traffic for malformed WRITE_ANDX requests with offset values inconsistent with packet size.
- Alert on unexpected system crashes or bugchecks on hosts running the affected Windows versions.
- Watch for SMB connections to the \PIPE\lsarpc named pipe from unusual or external sources.
- Use the provided OVAL definitions to scan for missing MS09-001 patches.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-4114 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-4114), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
