Skip to content
Fencer Vulns
critical 10.0

CVE-2006-3439 in the critical feed json

Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including…

published 2006-08-09 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-3435

cvss
10.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
85.1%
EPSS 85.1% chance of exploitation in 30 days, percentile 99.7%
public exploits
6
Metasploit, Exploit-DB

Summary

Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/windows/smb/ms06_040_netapi)
  2. Published

Exploit prediction

85.08% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/smb/ms06_040_netapi MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow metasploit exploit, good rank, 2006-08-08
  • EDB-16367 Microsoft Server Service - NetpwPathCanonicalize Overflow (MS06-040) (Metasploit) remote, 2011-02-17
  • EDB-2355 Microsoft Windows Server 2003 - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit) remote, 2006-09-13
  • EDB-2265 Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (2) remote, 2006-08-28
  • EDB-2223 Microsoft Windows - CanonicalizePathName() Remote (MS06-040) remote, 2006-08-19
  • EDB-2162 Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit) remote, 2006-08-10

CVSS scores

assigned by version score vector
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.