CVE-2004-0118

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 22.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-06-01 · updated 2026-06-16

Description

The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code.

Affected products

Microsoft Windows 2000: all versions
Microsoft Windows Nt: 4.0

References

http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020070.html
http://www.ciac.org/ciac/bulletins/o-114.shtml
http://www.eeye.com/html/Research/Advisories/AD20040413E.html
http://www.kb.cert.org/vuls/id/783748
http://www.securityfocus.com/bid/10117
http://www.us-cert.gov/cas/techalerts/TA04-104A.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011
https://exchange.xforce.ibmcloud.com/vulnerabilities/15714
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1512
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1718
http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020070.html
http://www.ciac.org/ciac/bulletins/o-114.shtml

Get alerted when CVE-2004-0118 or the next vulnerability affects your stack