CVE-2010-2550: Microsoft Windows SMB Server pool overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 score of 10.0 with network vector, no authentication, and complete impact, combined with very high EPSS probability, makes this a top-priority patching target.

What it is

The SMB Server in multiple Windows versions fails to properly validate fields in an SMB request, leading to a pool overflow. A remote, unauthenticated attacker can send a crafted SMB packet to execute arbitrary code with system privileges. This is a network-reachable, pre-authentication flaw in a core Windows service.

Impact

An attacker can execute arbitrary code on the target system, typically with SYSTEM privileges, leading to full compromise. This enables installation of malware, data theft, or use of the host as a pivot point.

Attack surface

Reachable over the network via SMB (TCP 445 or 139); no authentication or user interaction is required per the AV:N/AC:L/Au:N vector. Any host exposing the SMB Server service is potentially vulnerable.

Exploitation

Not listed in CISA KEV, but EPSS probability is 0.7572 (99.5th percentile), indicating a high likelihood of exploitation activity. No public exploit references are tagged in the record.

What to do

• Apply Microsoft security bulletin MS10-054 immediately on all affected Windows versions.
• Block inbound SMB traffic (TCP 445 and 139) at network boundaries where not required.
• Disable the SMB Server service on systems that do not need to share files or printers.
• Segment networks to limit lateral movement from compromised hosts.
• Monitor for and restrict SMB access to trusted internal hosts only.

Detection

• Inspect SMB traffic for malformed or unusually large packets targeting port 445/139.
• Monitor Windows event logs for unexpected SMB Server crashes or restarts (e.g., Event ID 1000 or service failures).
• Use network IDS/IPS signatures for SMB pool overflow attempts if available.
• Track EPSS and vendor advisories for updated exploitation indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.