CVE-2010-0477: Windows SMB Client Message Size Flaw Allows Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10 with network reachability, no authentication, and complete impact, combined with a high EPSS percentile, makes this a top-priority patching target despite no known in-the-wild exploitation.

What it is

The SMB client in Windows 7 and Windows Server 2008 R2 mishandles SMBv1 and SMBv2 response packets, reading the entire response and then interacting incorrectly with the Winsock Kernel (WSK). A malicious or man-in-the-middle SMB server can trigger memory corruption that leads to remote code execution on the connecting client.

Impact

An attacker can execute arbitrary code with the privileges of the SMB client process, typically SYSTEM, giving full control of the affected host. This can lead to complete compromise of confidentiality, integrity, and availability.

Attack surface

Reached over the network when a Windows 7 or Server 2008 R2 system connects to an attacker-controlled or compromised SMB server; no authentication or user interaction is required on the client side beyond initiating an SMB connection. The CVSS vector AV:N/AC:L/Au:N confirms network reachability with no authentication.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded, but EPSS is high (0.50, 98.9th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS10-020 immediately on all Windows 7 and Windows Server 2008 R2 systems.
• Restrict outbound SMB traffic (TCP 445/139) to trusted internal servers only, blocking client connections to untrusted or external SMB endpoints.
• Enforce SMB signing where feasible to reduce man-in-the-middle tampering with SMB responses.
• Segment networks and monitor for anomalous SMB client connections to unexpected hosts.
• Where patching is delayed, consider disabling or limiting SMB client access on systems that do not require it.

Detection

• Monitor SMB client connections to external or unusual IP addresses, especially from Windows 7/Server 2008 R2 hosts.
• Look for crashes or unexpected process terminations in SMB client components (mrxsmb.sys, mrxsmb10.sys, mrxsmb20.sys) that could indicate malformed response handling.
• Use network monitoring to detect SMB response packets with abnormal sizes or malformed structures.
• Correlate host logs for suspicious child processes spawned by SMB client or SYSTEM-level activity following SMB connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.