CVE-2006-3942
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote...
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
Exploit likelihood
What each source reports
NVD Score used
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
- Record
CVE-2006-3942- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
- Record
CVE-2006-3942- Updated
- 2026-11-02
EUVDEUVD-2006-3935 No score
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
- Record
EUVD-2006-3935- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3f78-rrw8-v6hw No score
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote...
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability. NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
- Record
GHSA-3f78-rrw8-v6hw- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows - Mailslot Ring0 Memory Corruption (MS06-035) | 2006-07-21 |
| Metasploit | Microsoft SRV.SYS Mailslot Write Corruption | 2006-07-11 |
| Metasploit | Microsoft SRV.SYS Pipe Transaction No Null |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3942 is a high vulnerability (CVSS 7.8) in Microsoft Windows 2000, published July 31, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.0%, the 99th percentile. No source names a fixed version.
References
xforce.iss.net/xforce/alerts/id/231
vupen.com/english/advisories/2006/3037
securityfocus.com/archive/1/449179/100/0/threaded
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-063
Show 10 moreShow less
coresecurity.com/common/showdoc.php?idx=562&idxseccion=10
securitytracker.com/id?1016606
secunia.com/advisories/21276
osvdb.org/27644
exchange.xforce.ibmcloud.com/vulnerabilities/27999
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A428
blogs.technet.com/msrc/archive/2006/07/28/443837.aspx
nvd.nist.gov/vuln/detail/CVE-2006-3942
github.com/advisories/GHSA-3f78-rrw8-v6hw