Vulnerability record · CVE-2010-0242 · published 10 February 2010
CVE-2010-0242: Windows TCP/IP SACK handling denial of service
Microsoft · Windows Server 2008
Microsoft Windows Vista and Server 2008 fail to properly handle malformed TCP selective acknowledgement (SACK) values, allowing a remote attacker to hang the system. The flaw is a denial-of-service condition in the TCP/IP stack that requires no authentication or user interaction, so any reachable host is exposed.
Description
The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via crafted packets with malformed TCP selective acknowledgement (SACK) values, aka "TCP/IP Selective Acknowledgement Vulnerability."
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityRemote, unauthenticated, low-complexity denial of service with complete availability impact and high EPSS, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
Microsoft Windows Vista and Server 2008 fail to properly handle malformed TCP selective acknowledgement (SACK) values, allowing a remote attacker to hang the system. The flaw is a denial-of-service condition in the TCP/IP stack that requires no authentication or user interaction, so any reachable host is exposed.
Impact
An attacker can cause a full system hang, making the machine unavailable until it is restarted. No code execution, data disclosure, or integrity impact is described.
Attack surface
Reachable over the network via crafted TCP packets containing malformed SACK values; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged, but EPSS is high (0.658, 99th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Apply Microsoft security bulletin MS10-009 (patch) to affected Vista and Server 2008 systems.
- Restrict or filter inbound TCP traffic to exposed hosts where feasible, especially from untrusted networks.
- Retire or isolate unsupported Windows Vista and Server 2008 Gold/SP1/SP2 systems that cannot be patched.
- Monitor vendor guidance and US-CERT alert TA10-040A for any updated remediation steps.
Detection
- Watch for sudden host unresponsiveness or system hangs correlated with inbound TCP traffic.
- Inspect network captures for TCP segments with malformed or anomalous SACK option values.
- Alert on repeated connection attempts to a host immediately preceding a hang or reboot event.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-0242 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-0242), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
