CVE-2009-3103: Microsoft Windows SMBv2 Negotiation Out-of-Bounds Memory Corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0, remote unauthenticated code execution, and public exploit code with very high EPSS make this an urgent risk.

What it is

The SMBv2 implementation in srv2.sys mishandles an ampersand character in the Process ID High header field of a NEGOTIATE PROTOCOL REQUEST packet, causing an array index error and out-of-bounds memory dereference. This allows a remote, unauthenticated attacker to crash the system or potentially execute arbitrary code with full privileges.

Impact

An attacker can cause a denial of service (system crash) or execute arbitrary code in kernel context, gaining complete control of the affected host.

Attack surface

Reachable over the network via SMB (TCP 445) by sending a crafted NEGOTIATE PROTOCOL REQUEST packet; no authentication or user interaction is required.

Exploitation

Public exploit code is referenced (Exploit tags in references), and EPSS indicates a very high probability of exploitation activity (0.90227, 99.79th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply Microsoft security bulletin MS09-050 immediately.
• Disable SMBv2 if it is not required, or block TCP port 445 at network boundaries.
• Segment networks to limit SMB exposure to trusted hosts only.
• Monitor for and restrict outbound SMB traffic to prevent lateral movement.

Detection

• Inspect network traffic for SMB NEGOTIATE PROTOCOL REQUEST packets containing an ampersand in the Process ID High field.
• Monitor Windows system logs for unexpected crashes or bugcheck events in srv2.sys.
• Use IDS/IPS signatures that detect malformed SMBv2 negotiation packets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.