CVE-2006-2373
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2,...
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."
- Record
CVE-2006-2373- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."
- Record
CVE-2006-2373- Updated
- 2026-11-02
EUVDEUVD-2006-2374 No score
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."
- Record
EUVD-2006-2374- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r428-mp7p-g7p8 No score
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2,...
The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to execute arbitrary code by calling the MrxSmbCscIoctlOpenForCopyChunk function with the METHOD_NEITHER method flag and an arbitrary address, possibly for kernel memory, aka the "SMB Driver Elevation of Privilege Vulnerability."
- Record
GHSA-r428-mp7p-g7p8- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows - NtClose DeadLock (MS06-030) | 2006-06-14 |
| Exploit-DB | Microsoft Windows XP/2000 - 'Mrxsmb.sys' Local Privilege Escalation (MS06-030) | 2006-06-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2373 is a high vulnerability (CVSS 10.0) in Microsoft Windows 2000, published June 13, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 29.2%, the 98th percentile. No source names a fixed version.
References
securitytracker.com/id?1016288
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1942
idefense.com/intelligence/vulnerabilities/display.php?id=408
vupen.com/english/advisories/2006/2327
Show 10 moreShow less
osvdb.org/26440
securityfocus.com/bid/18356
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-030
secunia.com/advisories/20635
exchange.xforce.ibmcloud.com/vulnerabilities/26828
nvd.nist.gov/vuln/detail/CVE-2006-2373
github.com/advisories/GHSA-r428-mp7p-g7p8