CVE-2020-1206

🗓️ 25 Aug 2026 13:41:11Reported by KitPloitType

kitploit🔗 kitploit.com👁 1 Views

Integer overflow in srv2.sys Srv2DecompressData enables write-what-where primitive.

Reporter	Title	Published	Views	Family All 332
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	8 Dec 202020:37	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	6 May 202015:20	–	gitee
Gitee	Exploit for CVE-2013-0422	20 Dec 202018:43	–	gitee
Gitee	Exploit for CVE-2013-0422	5 Aug 202014:46	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	6 Jul 202114:08	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	15 Nov 202122:01	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	4 Jun 202023:09	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	4 Jun 202010:07	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	20 Apr 202110:15	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	11 Mar 202117:57	–	gitee

Source	Link
github	www.github.com/ZecOps/CVE-2020-0796-RCE-POC/blob/793b9360347b40341c5128bf9723edbd7c492b24/leak_pool_address.py
github	www.github.com/datntsec/cve-2020-1206/blob/HEAD/SpLsaModeInitialize--%3ENtLmFunctionTable.SpAcceptLsaModeContext--%3ESsprHandleAuthenticateMessage--%3ESspContextGetMessage
github	www.github.com/datntsec/CVE-2020-1206
github	www.github.com/datntsec/CVE-2020-0796
github	www.github.com/ZecOps/CVE-2020-1206-POC
github	www.github.com/MITRECND/chopshop/blob/master/ext_libs/lznt1.py
connormcgarr	www.connormcgarr.github.io/pte-overwrites/
github	www.github.com/datntsec/CVE-2020-1206

25 Aug 2026 13:41Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.110

EPSS0.9981

SSVC

srv2.sys integer overflow write-what-where SMB compression Srv2DecompressData