CVE-2010-2551: Windows SMB Server variable validation flaw causes system hang

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service against a core Windows service with a high EPSS score, though no confirmed in-the-wild exploitation is documented.

What it is

The SMB Server in Windows Vista SP1/SP2, Windows Server 2008 Gold/SP2/R2, and Windows 7 fails to properly validate an internal variable in an SMB packet. A remote attacker can send a crafted SMBv1 or SMBv2 packet to hang the system, disrupting availability of the SMB service and the host. The record is old and thin on exploit specifics, but the flaw is a straightforward input validation failure in a network-facing service.

Impact

An unauthenticated remote attacker can cause a denial of service by hanging the affected system, taking down file sharing and any dependent services. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via SMB (TCP 445/139) with no authentication or user interaction required, per the AV:N/AC:L/Au:N vector. Any host exposing the SMB Server to untrusted networks is exposed.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high (0.666, 99th percentile), indicating elevated predicted exploitation likelihood, but the record contains no reference tags confirming public exploit code or in-the-wild use.

What to do

• Apply Microsoft security bulletin MS10-054 (the vendor fix) to all affected Windows Vista, Server 2008, and Windows 7 systems.
• Block inbound SMB (TCP 445 and 139) from untrusted networks at the perimeter and host firewalls.
• Disable or restrict SMB services on hosts that do not require file sharing.
• Segment networks so SMB traffic is confined to trusted zones and monitor for anomalous SMB packet patterns.

Detection

• Monitor SMB server logs and Windows event logs for unexpected service hangs or crashes on affected hosts.
• Use network IDS/IPS signatures for malformed SMBv1/SMBv2 packets targeting port 445/139.
• Track availability gaps in SMB-dependent services and correlate with inbound SMB traffic from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.