CVE-2010-0478: Windows Media Unicast Service nsum.exe stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityThe flaw is a remotely reachable, unauthenticated buffer overflow with a CVSS 2.0 score of 9.3 and a very high EPSS percentile, and the affected platform is unsupported.

What it is

A stack-based buffer overflow exists in nsum.exe, part of the Windows Media Unicast Service in Media Services on Windows 2000 Server SP4. Crafted packets carrying transport information can overflow a stack buffer, allowing remote code execution. The flaw matters because it is network-reachable and can be triggered without authentication.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the Media Unicast Service, typically SYSTEM on Windows 2000 Server. This can lead to full compromise of the server.

Attack surface

The vulnerability is reached over the network through the Media Unicast Service listening endpoint; the CVSS vector AV:N/Au:N indicates no authentication is required. The AC:M rating suggests some conditions must be met for a successful exploit, but no user interaction is described.

Exploitation

CVE-2010-0478 is not listed in CISA KEV and has no known ransomware association in the record. EPSS shows a 30-day probability of 0.6042 (99.1st percentile), indicating high predicted likelihood of exploitation activity, though the references do not include exploit tags.

What to do

• Apply Microsoft security bulletin MS10-025 (the vendor fix for this vulnerability) as the first action.
• If Windows 2000 Server SP4 cannot be patched, disable or stop the Windows Media Unicast Service where it is not required.
• Block or restrict network access to the Media Services/Unicast Service ports at the perimeter and between untrusted network segments.
• Retire or isolate Windows 2000 Server SP4 systems, since the platform is out of support and cannot receive future fixes.
• Monitor vendor and US-CERT advisories for any updated guidance on MS10-025.

Detection

• Monitor for crashes or unexpected restarts of nsum.exe or the Windows Media Unicast Service.
• Inspect network traffic to the Media Services/Unicast Service for malformed or unusually large transport-information packets.
• Review Windows 2000 Server event logs for service failures or suspicious process creation following Media Services activity.
• Use host-based monitoring to detect unexpected child processes or code execution originating from nsum.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.