CVE-2020-0796
Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems
Published 12 Mar 2020 · updated 1 Oct 2026 · Analyzed
10.0 Critical · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 10 Feb 2022, with a remediation deadline of 10 Aug 2022 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply updates per vendor instructions.
Description
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
References
- packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html · Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html · Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html · Exploit, Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html · Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html · Third Party Advisory, VDB Entry
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 · Patch, Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796 · US Government Resource