Vulnerability record · CVE-2009-2526 · published 14 October 2009
CVE-2009-2526: Microsoft Windows SMBv2 packet field validation flaw causes system hang
Microsoft · Windows Server 2008
Microsoft Windows Vista and Server 2008 fail to properly validate fields in SMBv2 packets, allowing a crafted packet sent to the Server service to trigger an infinite loop and hang the system. This is a remote, unauthenticated denial-of-service condition affecting the SMB server component.
Description
Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server service, aka "SMBv2 Infinite Loop Vulnerability."
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityRemote, unauthenticated, low-complexity denial of service with complete availability impact and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
Microsoft Windows Vista and Server 2008 fail to properly validate fields in SMBv2 packets, allowing a crafted packet sent to the Server service to trigger an infinite loop and hang the system. This is a remote, unauthenticated denial-of-service condition affecting the SMB server component.
Impact
A remote attacker can cause the affected system to hang indefinitely, disrupting availability of the SMB service and the host. No confidentiality or integrity impact is described; the effect is purely denial of service.
Attack surface
Reachable over the network via SMBv2 traffic to the Server service (AV:N, AC:L, Au:N), requiring no authentication and no user interaction. Any host exposing SMBv2 on Vista or Server 2008 is a candidate target.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.81891, 99.6th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Apply the Microsoft security update for MS09-050 (KB975517) on all affected Vista and Server 2008 systems.
- Disable SMBv2 where it is not required, or restrict SMB exposure to trusted networks only.
- Block inbound TCP 445 and 139 at network boundaries and between untrusted segments.
- Monitor vendor advisories and US-CERT alert TA09-286A for updated guidance.
Detection
- Monitor for unexpected SMB service hangs or unresponsive hosts and correlate with inbound SMBv2 traffic.
- Inspect SMBv2 traffic for malformed or anomalous packet fields using network IDS signatures where available.
- Alert on repeated SMB connection attempts from untrusted sources targeting TCP 445/139.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-2526 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-2526), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
