CVE-2010-0270: Windows SMB Client Transaction Response Validation Flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw permits remote code execution with a 10.0 CVSS 2.0 score and high EPSS, but exploitation requires the client to connect to a hostile or intercepted SMB server and no KEV listing or confirmed in-the-wild use is documented.

What it is

The SMB client in Windows 7 and Windows Server 2008 R2 fails to properly validate fields in SMB transaction responses. A malicious or compromised SMB server, or a man-in-the-middle, can send a crafted SMBv1 or SMBv2 response that triggers memory corruption in the client. This is a client-side flaw, so the vulnerable machine must initiate an SMB connection to a hostile or intercepted server.

Impact

Successful exploitation allows remote code execution in the context of the SMB client process, or a denial of service that crashes and reboots the machine. The CVSS 2.0 vector rates full confidentiality, integrity and availability impact.

Attack surface

Reached over the network via SMB (AV:N, AC:L, Au:N), but the client must connect outbound to an attacker-controlled or man-in-the-middle SMB server; no authentication or user interaction beyond that connection is required per the vector. The description does not specify which SMB client components or ports are involved beyond SMBv1 and SMBv2.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.48188, 98.8th percentile), indicating elevated predicted exploitation likelihood, but the record contains no reference tags confirming public exploit code or in-the-wild use.

What to do

• Apply Microsoft security bulletin MS10-020 (the vendor fix for this issue) to all Windows 7 and Windows Server 2008 R2 systems.
• Restrict outbound SMB traffic (TCP 445/139) to trusted internal servers so clients cannot reach untrusted or attacker-controlled SMB endpoints.
• Enforce SMB signing where feasible to make man-in-the-middle tampering with SMB responses detectable.
• Retire or isolate Windows 7 and Windows Server 2008 R2 systems that cannot be patched, since these platforms are out of mainstream support.
• Monitor and alert on unexpected outbound SMB connections from client systems to non-standard or external hosts.

Detection

• Hunt for client systems making outbound SMB connections to hosts outside the normal server inventory, especially external or newly seen IPs.
• Monitor for unexpected reboots or SMB client process crashes on Windows 7 and Server 2008 R2 hosts.
• Review SMB client event logs and crash dumps for memory corruption faults tied to SMB transaction handling.
• Use network monitoring to flag malformed or anomalous SMBv1/SMBv2 transaction responses from servers to clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.