Vulnerability record · CVE-2010-0022 · published 10 February 2010
CVE-2010-0022: Microsoft Windows SMB Server Null Pointer Denial of Service
Microsoft · Windows 2000
The SMB Server service in multiple Windows versions fails to properly validate the share and servername fields in SMB packets, leading to a null pointer dereference. A remote attacker can send a crafted SMB packet to hang the affected system, causing a denial of service.
Description
The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate the share and servername fields in SMB packets, which allows remote attackers to cause a denial of service (system hang) via a crafted packet, aka "SMB Null Pointer Vulnerability."
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityThe flaw allows unauthenticated remote denial of service with a high EPSS score, though no known active exploitation in KEV.
What it is
The SMB Server service in multiple Windows versions fails to properly validate the share and servername fields in SMB packets, leading to a null pointer dereference. A remote attacker can send a crafted SMB packet to hang the affected system, causing a denial of service.
Impact
An unauthenticated remote attacker can cause a complete system hang, disrupting all services and requiring a restart. There is no loss of confidentiality or integrity, only availability.
Attack surface
The vulnerability is reachable over the network via SMB (typically TCP port 445). No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/Au:N.
Exploitation
The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation activity (0.78338, 99.558th percentile). No public exploit references are tagged in the provided data.
What to do
- Apply the Microsoft security update MS10-012 immediately on all affected Windows versions.
- Block SMB traffic (TCP 445) from untrusted networks at the perimeter firewall.
- Disable the Server service (LanmanServer) on systems that do not require file and printer sharing.
- Upgrade or migrate from unsupported operating systems such as Windows 2000, XP, and Server 2003.
Detection
- Monitor for unexpected SMB session terminations or system hangs on affected hosts.
- Use network intrusion detection to flag malformed SMB packets targeting the share and servername fields.
- Audit Windows event logs for unexpected service crashes or reboots correlated with SMB traffic.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-0022 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-0022), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
