CVE-2020-0796

CVE-2020-0796 is a critical-severity vulnerability in Microsoft Windows 10 1903 with a CVSS 3.x base score of 10.0. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-02-10). The underlying weakness is classified as CWE-119.

Key facts

Description

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution Vulnerability

AI-generated analysis based on the vulnerability data on this page.

| CVE | CVE-2020-0796 |
| CVSS v3 | 10.0 (Critical) |
| CVSS v2 | 7.5 |
| EPSS | 0.9981 |
| KEV | Yes (since 2022-02-10) |
| CWE | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
| Affected | Windows 10 1903, Windows 10 1909, Windows Server 1903, Windows Server 1909 |

Summary

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An unauthenticated attacker could exploit this flaw by sending a specially crafted request to a vulnerable SMBv3 server, or by convincing a user to connect to a malicious SMBv3 server.

Background

SMBv3.1.1 is the protocol version affected by this vulnerability. The issue relates to how this protocol implementation processes certain incoming requests, leading to a buffer overflow condition that can be exploited for remote code execution.

Root Cause

The vulnerability is classified as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer. The SMBv3.1.1 implementation fails to properly validate the size of data before copying it into a buffer, leading to a buffer overflow condition. When a specially crafted request is processed, data can be written beyond the allocated buffer boundary, potentially allowing an attacker to execute arbitrary code.

Impact

  • CVSS 3.1 Score: 10.0 (Critical) — Network exploitable with low attack complexity, no privileges required, no user interaction, and changed scope.
  • Confidentiality Impact: HIGH — An attacker can gain access to all data on the system.
  • Integrity Impact: HIGH — An attacker can modify or delete any data on the system.
  • Availability Impact: HIGH — An attacker can render the system completely unavailable.
  • Scope: CHANGED — The vulnerable component impacts resources beyond its security scope.

Exploitation Walkthrough

Defensive Context Only. This section is for understanding attack patterns to improve detection and prevention.
Ethics caveat: Attempting to exploit this vulnerability on systems you do not own or have explicit permission to test is illegal and unethical.

  1. Reconnaissance: The attacker identifies target systems running Windows 10 version 1903/1909 or Windows Server 1903/1909 with SMBv3.1.1 enabled.
  2. Initial Access: The attacker sends a specially crafted SMBv3.1.1 request to a vulnerable server. Alternatively, the attacker hosts a malicious SMB server and tricks a victim client into connecting.
  3. Buffer Overflow: The vulnerable SMBv3.1.1 implementation copies payload data without proper bounds checking, causing a buffer overflow.
  4. Code Execution: By controlling the overflowed buffer content, the attacker may achieve arbitrary code execution in the context of the SMB service.

Affected and Patched Versions

  • Affected:

    • Windows 10 version 1903 (x86, x64, ARM64)
    • Windows 10 version 1909 (x86, x64, ARM64)
    • Windows Server version 1903 (x64)
    • Windows Server version 1909 (x64)

  • Patched Versions: Specific patch information (KB numbers) is not available in the source data. Administrators should consult the Microsoft Security Response Center advisory and apply all available security updates for the affected versions.

Remediation

  1. Apply Updates: Install the latest security updates from Microsoft for affected Windows 10 and Windows Server versions.
  2. Block SMB at Network Perimeter: Block TCP port 445 at the enterprise perimeter firewall to prevent external exploitation. Note: internal lateral movement may still be possible.
  3. Network Segmentation: Segment networks to limit SMB exposure to only necessary systems.
  4. Refer to Microsoft Advisory: Consult the Microsoft Security Response Center advisory for any additional workaround instructions specific to your environment.

Detection

  • Monitor for anomalous SMB traffic, especially unexpected or malformed requests.
  • Look for unexpected SMB connections to or from external sources.
  • Monitor endpoint behavior for signs of post-exploitation activity.
  • Use network intrusion detection systems (IDS) to identify potential exploitation attempts.

Assessment

  • EPSS: 0.9981 (99.81% probability of exploitation in the wild) — This indicates an extremely high likelihood of active exploitation.
  • KEV: Listed in CISA's Known Exploited Vulnerabilities Catalog since 2022-02-10. Also confirmed as exploited in the EU since 2022-02-10.
  • Lessons: New network protocol features must undergo rigorous security testing, including fuzz testing and bounds checking, especially when operating in privileged contexts. The high EPSS score and KEV status confirm that this vulnerability is a critical priority for patching.

References

Frequently asked questions

What is CVE-2020-0796?
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
How severe is CVE-2020-0796?
CVE-2020-0796 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-0796 being actively exploited?
Yes. CVE-2020-0796 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-02-10, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2020-0796?
CVE-2020-0796 primarily affects Microsoft Windows 10 1903. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-0796?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2020-0796 have an EU (EUVD) identifier?
Yes. CVE-2020-0796 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-2283. It is also flagged as exploited in the EUVD (since 2022-02-10).
When was CVE-2020-0796 published?
CVE-2020-0796 was published on 2020-03-12 and last updated on 2026-06-17.

References

Affected products (8)

More vulnerabilities in Microsoft Windows 10 1903

All CVEs affecting Microsoft Windows 10 1903 →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE: