CVE-2006-6296

Microsoft Windows 2000 SP4 and earlier - Denial of Service via RpcGetPrinterData Function

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6296. PoCs published by h07.

AI-analyzed exploit summary This exploit targets a memory allocation vulnerability in the Windows spoolss service via the GetPrinterData() function, causing a remote denial-of-service (DoS) by exhausting memory. It uses DCERPC to connect to the target and trigger the vulnerability by allocating a large memory buffer.

Description

The RpcGetPrinterData function in the Print Spooler (spoolsv.exe) service in Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service (memory consumption) via an RPC request that specifies a large 'offered' value (output buffer size), a variant of CVE-2005-3644.

Exploits (1)

exploitdb WORKING POC VERIFIED
by h07 · pythondoswindows
https://www.exploit-db.com/exploits/2879

This exploit targets a memory allocation vulnerability in the Windows spoolss service via the GetPrinterData() function, causing a remote denial-of-service (DoS) by exhausting memory. It uses DCERPC to connect to the target and trigger the vulnerability by allocating a large memory buffer.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows spoolss service (tested on Windows 2000 SP4)
No auth needed
Prerequisites: Network access to the target's SMB port (445) · Vulnerable Windows spoolss service
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/30717
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017330
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/21401
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23196
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/2879
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/914617
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4827

Scores

EPSS 0.2120
EPSS Percentile 97.3%

Details

CWE
CWE-399
Status published
Products (2)
microsoft/windows_2000 (2 CPE variants)
microsoft/windows_xp
Published Dec 05, 2006
Tracked Since Feb 18, 2026