CVE-2003-0825

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-03-03 · updated 2026-06-16
Weakness: CWE-20

Description

The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.

Affected products

Microsoft Windows 2000: all versions
Microsoft Windows 2003 Server: enterprise, enterprise_64-bit, r2, standard, web
Microsoft Windows Nt: 4.0, 4.0-sp1, 4.0-sp2, 4.0-sp3, 4.0-sp4, 4.0-sp5 (+2)

References

http://www.ciac.org/ciac/bulletins/o-077.shtml
http://www.kb.cert.org/vuls/id/445214
http://www.osvdb.org/3903
http://www.securityfocus.com/bid/9624
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-006
https://exchange.xforce.ibmcloud.com/vulnerabilities/15037
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A704
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A800
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A801
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A802
http://www.ciac.org/ciac/bulletins/o-077.shtml
http://www.kb.cert.org/vuls/id/445214

Get alerted when CVE-2003-0825 or the next vulnerability affects your stack