CVE-2010-0025
The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, aka "SMTP Memory Allocation Vulnerability."
Key facts
- CVSS score
- 5.0 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:N/A:N- Weakness (CWE)
- CWE-200
- EPSS score
- 21.5% (98th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2010-0057)
- Published
- April 14, 2010
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2010-0057 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / exchange server
- microsoft / exchange server
- microsoft / exchange server
- microsoft / exchange server
- microsoft / exchange server
- microsoft / windows 2000
- microsoft / windows 2003 server
- microsoft / windows server 2003
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows server 2008
- microsoft / windows xp
- microsoft / windows xp
- microsoft / windows xp
Certified products that may be affected
14 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Microsoft Windows Server 2008 R2 Hyper-V Release 6.1.7600 - Microsoft Corporation - Common Criteria BSI-DSZ-CC-0755-2012 - archived
- Microsoft Windows 7, Microsoft Windows Server 2008 R2 - Microsoft Corporation - Common Criteria CCEVS-VR-10390-2010 - archived
- Windows Server 2008 R2 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1339 - historical
- Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) - Microsoft Corporation - FIPS 140 1337 - historical
- Microsoft Windows Server 2008 R2 Kernel Mode Cryptographic Primitives Library (cng.sys) - Microsoft Corporation - FIPS 140 1335 - historical
See all 14 in the Security Certifications Explorer.
References
- http://secunia.com/advisories/39253(Third Party Advisory)
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-024(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12175(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain