CVE-2011-0654
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System ...
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a malformed BROWSER ELECTION message, leading to a heap-based buffer overflow, aka "Browser Pool Corruption Vulnerability." NOTE: some of these details are obtained from third party information.
Exploit likelihood
What each source reports
NVD Score used
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a malformed BROWSER ELECTION message, leading to a heap-based buffer overflow, aka "Browser Pool Corruption Vulnerability." NOTE: some of these details are obtained from third party information.
- Record
CVE-2011-0654- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a malformed BROWSER ELECTION message, leading to a heap-based buffer overflow, aka "Browser Pool Corruption Vulnerability." NOTE: some of these details are obtained from third party information.
- Record
CVE-2011-0654- Updated
- 2026-11-02
EUVDEUVD-2011-0672 No score
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a malformed BROWSER ELECTION message, leading to a heap-based buffer overflow, aka "Browser Pool Corruption Vulnerability." NOTE: some of these details are obtained from third party information.
- Record
EUVD-2011-0672- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mrp-9wx3-mfr6 No score
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System ...
Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a malformed BROWSER ELECTION message, leading to a heap-based buffer overflow, aka "Browser Pool Corruption Vulnerability." NOTE: some of these details are obtained from third party information.
- Record
GHSA-8mrp-9wx3-mfr6- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows Server 2003 - AD BROWSER ELECTION Remote Heap Overflow | 2011-02-14 |
| Metasploit | Microsoft Windows Browser Pool DoS |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0654 is a high vulnerability (CVSS 10.0) in Microsoft Windows Server 2003, published February 16, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 68.1%, the 99th percentile. No source names a fixed version.
References
blogs.technet.com/b/mmpc/archive/2011/02/16/my-sweet-valentine-the-cifs-browser-protocol-heap-corruption-vulnerability.aspx
us-cert.gov/cas/techalerts/TA11-102A.html
kb.cert.org/vuls/id/323172
exploit-db.com/exploits/16166
vupen.com/english/advisories/2011/0394
Show 10 moreShow less
securitytracker.com/id?1025328
archives.neohapsis.com/archives/fulldisclosure/2011-02/0284.html
securityfocus.com/bid/46360
secunia.com/advisories/43299
exchange.xforce.ibmcloud.com/vulnerabilities/65376
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-019
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12637
nvd.nist.gov/vuln/detail/CVE-2011-0654
github.com/advisories/GHSA-8mrp-9wx3-mfr6