CVE-2009-2532

EXPLOITED

Windows Vista and Server 2008 - Remote Code Execution via SMBv2 Command Value

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2009-2532 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits.

AI-analyzed exploit summary This exploit targets a vulnerability in Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference, allowing remote code execution on Vista SP1/SP2 systems. It spawns a reverse shell on port 28876, granting SYSTEM-level access.

Description

Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the Server service, aka "SMBv2 Command Value Vulnerability."

Exploits (2)

exploitdb WORKING POC
remotewindows
https://www.exploit-db.com/exploits/14674

This exploit targets a vulnerability in Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference, allowing remote code execution on Vista SP1/SP2 systems. It spawns a reverse shell on port 28876, granting SYSTEM-level access.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows Vista SP1/SP2 (SRV2.SYS)
No auth needed
Prerequisites: Network access to target SMB service · Vulnerable Vista SP1/SP2 system
devstral-2 · analyzed Feb 19, 2026 Full analysis →
exploitdb WORKING POC
pythonremotewindows
https://www.exploit-db.com/exploits/40280

This exploit targets CVE-2009-2532, a vulnerability in Microsoft Windows SMBv2, by sending a crafted SMB packet to trigger a buffer overflow, followed by an authentication attempt to execute the injected shellcode. The payload is a reverse TCP shell generated via msfvenom.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows SMBv2 (affected versions include Windows Vista and Server 2008)
No auth needed
Prerequisites: Network access to the target's SMB port (445) · Target system must be vulnerable to CVE-2009-2532
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3
Core References
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-286A.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6336

Scores

EPSS 0.6178
EPSS Percentile 98.4%

Details

VulnCheck KEV 2017-06-20
CWE
CWE-94
Status published
Products (2)
microsoft/windows_server_2008 (8 CPE variants)
microsoft/windows_vista (6 CPE variants)
Published Oct 14, 2009
Tracked Since Feb 18, 2026