CVSS 10.0 CRITICAL Bulletin: MS03-026 Published: 2003-07-16

CVE-2003-0352: Microsoft Windows RPC DCOM Interface Buffer Overflow (Blaster Worm)

Technical intelligence and weaponization dossier for CVE-2003-0352. Documented exploitation across 3 active malware families totaling 2,309 analyzed telemetry samples.

Attributed Families

Sample Volume

2,309

CVSS Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2003-0352
Common Name / Bulletin	Microsoft Windows RPC DCOM Interface Buffer Overflow (Blaster Worm) (`MS03-026`)
CWE Classification	`CWE-119: Memory Buffer Bounds Violation in RPCSS`
Affected Software & Versions	Microsoft Windows NT 4.0, 2000, XP, Server 2003
Technical Root Cause	Stack-based buffer overflow in RPCSS service handling Distributed Component Object Model (DCOM) interface requests over TCP port 135, enabling unauthenticated remote code execution with full SYSTEM privileges.
Associated ATT&CK Techniques	`T1210` — Associated ATT&CK Technique `T1059` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2003-0352

Empirical catalog telemetry verifies that the following 3 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

3 families

Malware Family	Category	Catalog Samples	Operational Profile
sdbot	Rat	`1,931`	SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first releas...
ircbot	Rat	`348`	Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentra...
blaster	Worm	`30`	Blaster (also widely cataloged as MSBlast, Lovsan, and Poosan) is one of the most famous and destructive self-propagating computer worms in internet history, fi...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2003-0352 in enterprise intrusions and campaign toolkits:

Global Cybercrime Syndicates — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2003-0352 in enterprise networks:

Network telemetry: Inbound TCP 135 RPC traffic containing DCERPC requests with excessively long object UUID path strings followed by immediate system shutdown RPC calls.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Apply MS03-026/MS03-039 cumulative updates; block inbound TCP ports 135, 139, 445 at perimeter firewalls; disable DCOM on non-essential endpoints.

For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →

← Return to Vulnerability Matrix Directory (All 63 CVEs)