Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remo…

published 2009-10-14 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2521

cvss: 7.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 81.9%; EPSS 81.9% chance of exploitation in 30 days, percentile 99.6%
public exploits: 2; Exploit-DB

Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server service, aka "SMBv2 Infinite Loop Vulnerability."

Timeline

2009-10-14 Published
2010-08-17 First public exploit (EDB-14674)

Exploit prediction

81.89% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-40280 Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050) remote, 2016-02-26
EDB-14674 Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) remote, 2010-08-17

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness

CWE-399 Resource Management Errors

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2009/ms09-050
vendor-advisory
us-cert.gov /cas/techalerts/TA09-286A.html
third-party-advisory, us-government-resource
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5595
vdb-entry, signature

Sources

CVE List CVE-2009-2526
NVD CVE-2009-2526

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary