Every CVE Search/ Get API key

CVE-2009-3103

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista...

10.0 HighPublic exploit

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Exploit likelihood

92.3%Up 4.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Record
CVE-2009-3103
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Record
CVE-2009-3103
Updated
2026-11-02
EUVDEUVD-2009-3086 No score

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Record
EUVD-2009-3086
Updated
2026-11-03
GitHub AdvisoriesGHSA-47wf-g7rm-46qq No score

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista...

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Record
GHSA-47wf-g7rm-46qq
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMicrosoft Windows 7/2008 R2 - Remote Kernel Crash2009-11-11
Exploit-DBMicrosoft Windows - SMB2 Negotiate Protocol '0x72' Response Denial of Service2010-05-07
Exploit-DBMicrosoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)2010-08-17
Exploit-DBMicrosoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050) (Metasploit)2010-07-03
Exploit-DBMicrosoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050)2016-02-26
Exploit-DBMicrosoft Windows Vista/7 - SMB2.0 Negotiate Protocol Request Remote Blue Screen of Death (MS07-063)2009-09-09
MetasploitMicrosoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
MetasploitMicrosoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference
MetasploitMS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference2009-09-07
PoC in GitHubSic4rio/CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-2023-12-20
Show 5 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubafifudinmtop/CVE-2009-31032026-01-26
PoC in GitHubbytejmp/MS09-0502026-09-18
PoC in GitHubnicolasdamians/ms09-050-CVE-2009-3103-exploit2025-12-21
PoC in GitHubsec13b/ms09-050_CVE-2009-31032023-10-29
PoC in GitHubsooklalad/ms090502017-01-17

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3103 is a high vulnerability (CVSS 10.0) in Microsoft Windows Server 2008, published September 8, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 92.3%, the 99th percentile. No source names a fixed version.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open