Read the docs
TI-2009-02958 Aliases CVE-2009-3103GHSA-47wf-g7rm-46qq

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows…

Priority CRITICAL 86CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, aka "SMBv2 Negotiation Vulnerability." NOTE: some of these details are obtained from third party information.

Why it matters now

EPSS 0.92347 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:sp2:x32:*:*:*:*:*:*sp2 x32VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:sp2:x64:*:*:*:*:*:*sp2 x64VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*all versionsVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:sp2:x32:*:*:*:*:*:* Versions sp2 x32 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:sp2:x64:*:*:*:*:*:* Versions sp2 x64 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3103
  2. 2026-10-03 Alias added: GHSA-47wf-g7rm-46qq

References

Exploit 3

Advisory 4

Other 5

  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01310 Improper input validation in Microsoft Windows Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-00485 Use after free in Microsoft Windows KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-06077 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01465 HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2008-04072 The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and… KEVCVSS 3.1CRITICAL 9.8
See all 3551 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences