CVE-2008-4835: Microsoft Windows SMB buffer size validation remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and high EPSS make this a top remediation priority despite no KEV listing.

What it is

The Server service SMB implementation in multiple Windows versions fails to sufficiently validate buffer sizes when handling malformed fields in an NT Trans2 request, allowing memory corruption that can lead to remote code execution. Because SMB is exposed on the network by default on affected systems, this is a wormable-class flaw requiring no credentials or user action.

Impact

A remote attacker can execute arbitrary code with the privileges of the SMB service, typically SYSTEM, giving full control of the target host.

Attack surface

Reachable over the network via SMB (TCP 445/139) by sending a crafted NT Trans2 request; the CVSS vector shows no privileges or user interaction required.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at roughly 0.45 (98.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS09-001 for the affected Windows versions as the primary fix.
• Block inbound SMB (TCP 445 and 139) at network boundaries and between untrusted segments.
• Disable or restrict the Server service on hosts that do not need to share files or printers.
• Retire or isolate unsupported platforms such as Windows 2000 and XP that cannot be fully patched.
• Monitor vendor and US-CERT advisories for updated guidance on this SMB flaw.

Detection

• Inspect SMB traffic for malformed or oversized NT Trans2 requests, especially unusual buffer size fields.
• Alert on SMB service crashes or unexpected restarts on affected Windows hosts.
• Watch for post-exploitation behavior such as new SYSTEM-level processes or outbound connections originating from SMB-serving hosts.
• Correlate IDS/IPS signatures for MS09-001 with host logs on unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.